Skip to content

Instantly share code, notes, and snippets.

@akserikawa
Created October 26, 2022 16:40
Show Gist options
  • Save akserikawa/569410b0a8d16263b126d7e462bb6d2a to your computer and use it in GitHub Desktop.
Save akserikawa/569410b0a8d16263b126d7e462bb6d2a to your computer and use it in GitHub Desktop.
Kusto Query Language tips: Loop through array of JSON objects and extract info in the same row
let FindString = "Event search string";
let Events = ContainerLog
| where LogEntry has FindString
| extend json=parse_json(LogEntry)
| extend events=json.context.events
| project TimeGenerated, events, toint(totalElapsedTime=json.context.total_elapsed_time_in_milliseconds);
Events
| mv-apply event=events on (
extend p=pack(tostring(event.event_name), event.elapsed_time_in_milliseconds)
| summarize bag=make_bag(p)
) | evaluate bag_unpack(bag)
| project-away events
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment