如何使用非简单名称访问 KQL 中 JSON 数组中的元素?

How do I access an element in a JSON array in KQL with a non simple name?

我有一个查询需要提取元素的值以进行进一步处理

InsightsMetrics
| where Name =="istio_requests_total"
| distinct Tags
| extend Tags = todynamic(Tags)
| extend clusterId = Tags['container-azm.ms/clusterId']

但使用'container-azm.ms/clusterId'似乎无效,我尝试了各种类型的转义和tostring() 但无济于事。 我也试过 bag_unpack 但我在访问结果列时仍然遇到同样的问题。 感谢任何帮助。

示例数据:

datatable (Tags: dynamic)[
dynamic ({"app":"istio-ingressgateway","chart":"gateways","connection_security_policy":"unknown","container.azm.ms/clusterId":"/subscriptions/060acc24-d63a/resourceGroups/test/providers/Microsoft.ContainerService/managedClusters/halted","container.azm.ms/clusterName":"kiwikube","destination_app":"unknown","destination_canonical_revision":"latest","destination_canonical_service":"vhs-node","destination_cluster":"Kubernetes","destination_principal":"spiffe://cluster.local/ns/default/sa/default", "destination_service_namespace":"default","destination_version":"unknown","destination_workload":"mhs-node","destination_workload_namespace":"default","grpc_response_status":"","heritage":"Tiller","hostName":"aks-system-33525945-vmss000001","install.operator.istio.io/owning-resource":"unknown","istio":"ingressgateway","istio.io/rev":"default","kubernetes.io/config.seen":"2022-05-11T14:50:38.9201780Z","kubernetes.io/config.source":"api","namespace":"istio-system","operator.istio.io/component":"IngressGateways","pod-template-hash":"755d6cb48f","pod_name":"istio-ingressgateway-755d588hf-b5phq","prometheus.io/path":"/stats/prometheus","prometheus.io/port":"15020","prometheus.io/scrape":"true","release":"istio","reporter":"source","request_protocol":"http","response_code":"0","response_flags":"DC","service.istio.io/canonical-name":"istio-ingressgateway","service.istio.io/canonical-revision":"latest","sidecar.istio.io/inject":"false","source_app":"istio-ingressgateway","source_canonical_revision":"latest","source_canonical_service":"istio-ingressgateway","source_cluster":"Kubernetes","source_principal":"spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account","source_version":"unknown","source_workload":"istio-ingressgateway","source_workload_namespace":"istio-system"}),
]

哎哟:-)

您的密钥应以 container.azm 开头(conteiner azm

datatable (Tags: dynamic)[
dynamic ({"app":"istio-ingressgateway","chart":"gateways","connection_security_policy":"unknown","container.azm.ms/clusterId":"/subscriptions/060acc24-d63a/resourceGroups/test/providers/Microsoft.ContainerService/managedClusters/halted","container.azm.ms/clusterName":"kiwikube","destination_app":"unknown","destination_canonical_revision":"latest","destination_canonical_service":"vhs-node","destination_cluster":"Kubernetes","destination_principal":"spiffe://cluster.local/ns/default/sa/default", "destination_service_namespace":"default","destination_version":"unknown","destination_workload":"mhs-node","destination_workload_namespace":"default","grpc_response_status":"","heritage":"Tiller","hostName":"aks-system-33525945-vmss000001","install.operator.istio.io/owning-resource":"unknown","istio":"ingressgateway","istio.io/rev":"default","kubernetes.io/config.seen":"2022-05-11T14:50:38.9201780Z","kubernetes.io/config.source":"api","namespace":"istio-system","operator.istio.io/component":"IngressGateways","pod-template-hash":"755d6cb48f","pod_name":"istio-ingressgateway-755d588hf-b5phq","prometheus.io/path":"/stats/prometheus","prometheus.io/port":"15020","prometheus.io/scrape":"true","release":"istio","reporter":"source","request_protocol":"http","response_code":"0","response_flags":"DC","service.istio.io/canonical-name":"istio-ingressgateway","service.istio.io/canonical-revision":"latest","sidecar.istio.io/inject":"false","source_app":"istio-ingressgateway","source_canonical_revision":"latest","source_canonical_service":"istio-ingressgateway","source_cluster":"Kubernetes","source_principal":"spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account","source_version":"unknown","source_workload":"istio-ingressgateway","source_workload_namespace":"istio-system"}),
]
| project Tags["container.azm.ms/clusterId"]
Tags_container.azm.ms/clusterId
/subscriptions/060acc24-d63a/resourceGroups/test/providers/Microsoft.ContainerService/managedClusters/halted

Fiddle