如何解决如何在具有多层的 kusto/data explorer 中扩展 JSON 数据？
根据这篇 Microsoft 文章，我正在尝试将 JSON 数组数据（特别是“对象”数组）摄取到 Azure 数据资源管理器中。 （仅 JSON 数组部分）
我的 JSON 数据与示例不同，因为它在 JSON 中有一个附加层，当将原始事件行扩展到第二个表时，输入的行为空。我假设该函数无法使用 kusto 函数找到“对象”？
.create function EventRecordsExpand() {
rawhsievents
| mv-expand Objects = Event
| project
AlarmState = tostring(Objects["AlarmState"]),AreaOfInterest = tostring(Objects["AreaOfInterest"]),Category = tostring(Objects["Category"]),EncodedMessage = tostring(Objects["EncodedMessage"]),Fullname = tostring(Objects["Fullname"]),Id = tolong(Objects["Id"]),Message = tostring(Objects["Message"]),ReceiptTime = todatetime(Objects["ReceiptTime"]),RecordTime = todatetime(Objects["RecordTime"]),Severity = tostring(Objects["Severity"]),User = tostring(Objects["User"])
}
我的 JSON 数据示例如下：
{
"ExportedEvents": {
"Header": {
"SystemName": "Mids","StartDate": "2020-11-03T12:28:00.55Z","EndDate": "2020-11-03T12:28:11.521Z"
},"Objects": [{
"AlarmState": "","AreaOfInterest": "","Category": "Action","EncodedMessage": "Kernel,469,M(Lib,101,S\"RequestExportXML\")","Fullname": "System Resources.XML Interface.Support Processes.Batch Scheduler.Batch Schedule Scanner","Id": 456020,"Message": "RequestExportXML request rejected - Invalid configuration","ReceiptTime": "2020-11-03T12:28:00.55Z","RecordTime": "2020-11-03T12:28:00.55Z","Severity": "Low","User": "Schedule"
},{
"AlarmState": "","ReceiptTime": "2020-11-03T12:28:00.551Z","RecordTime": "2020-11-03T12:28:00.551Z","User": "Schedule"
}
]
}
}
我是否需要第二个 mv-expand 来扩展数据两次？
解决方法
您似乎mv-expand使用了错误的动态对象，您需要先访问 ExportedEvents.Objects。
例如：
datatable(Event:dynamic)
[
dynamic({
"ExportedEvents": {
"Header": {
"SystemName": "Mids","StartDate": "2020-11-03T12:28:00.55Z","EndDate": "2020-11-03T12:28:11.521Z"
},"Objects": [{
"AlarmState": "","AreaOfInterest": "","Category": "Action","EncodedMessage": "Kernel,469,M(Lib,101,S\"RequestExportXML\")","Fullname": "System Resources.XML Interface.Support Processes.Batch Scheduler.Batch Schedule Scanner","Id": 456020,"Message": "RequestExportXML request rejected - Invalid configuration","ReceiptTime": "2020-11-03T12:28:00.55Z","RecordTime": "2020-11-03T12:28:00.55Z","Severity": "Low","User": "Schedule"
},{
"AlarmState": "","ReceiptTime": "2020-11-03T12:28:00.551Z","RecordTime": "2020-11-03T12:28:00.551Z","User": "Schedule"
}
]
}
})
]
| mv-expand Objects = Event.ExportedEvents.Objects
| project
AlarmState = tostring(Objects["AlarmState"]),AreaOfInterest = tostring(Objects["AreaOfInterest"]),Category = tostring(Objects["Category"]),EncodedMessage = tostring(Objects["EncodedMessage"]),Fullname = tostring(Objects["Fullname"]),Id = tolong(Objects["Id"]),Message = tostring(Objects["Message"]),ReceiptTime = todatetime(Objects["ReceiptTime"]),RecordTime = todatetime(Objects["RecordTime"]),Severity = tostring(Objects["Severity"]),User = tostring(Objects["User"])
返回：
| AlarmState | AreaOfInterest | Category | EncodedMessage | Fullname | Id | Message | ReceiptTime | RecordTime | Severity | User |
|------------|----------------|----------|-------------------------------------------|-----------------------------------------------------------------------------------------|--------|-----------------------------------------------------------|-----------------------------|-----------------------------|----------|----------|
| | | Action | Kernel,S"RequestExportXML") | System Resources.XML Interface.Support Processes.Batch Scheduler.Batch Schedule Scanner | 456020 | RequestExportXML request rejected - Invalid configuration | 2020-11-03 12:28:00.5500000 | 2020-11-03 12:28:00.5500000 | Low | Schedule |
| | | Action | Kernel,S"RequestExportXML") | System Resources.XML Interface.Support Processes.Batch Scheduler.Batch Schedule Scanner | 456020 | RequestExportXML request rejected - Invalid configuration | 2020-11-03 12:28:00.5510000 | 2020-11-03 12:28:00.5510000 | Low | Schedule |
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。