Created
October 26, 2022 16:40
-
-
Save akserikawa/569410b0a8d16263b126d7e462bb6d2a to your computer and use it in GitHub Desktop.
Kusto Query Language tips: Loop through array of JSON objects and extract info in the same row
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| let FindString = "Event search string"; | |
| let Events = ContainerLog | |
| | where LogEntry has FindString | |
| | extend json=parse_json(LogEntry) | |
| | extend events=json.context.events | |
| | project TimeGenerated, events, toint(totalElapsedTime=json.context.total_elapsed_time_in_milliseconds); | |
| Events | |
| | mv-apply event=events on ( | |
| extend p=pack(tostring(event.event_name), event.elapsed_time_in_milliseconds) | |
| | summarize bag=make_bag(p) | |
| ) | evaluate bag_unpack(bag) | |
| | project-away events |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment