Question 109400 in Json Question posted in
Our archive of expertly curated questions and answers provides insights and solutions to common problems related to this popular data interchange format. From parsing and manipulating JSON data to integrating it with various programming languages and web services, our archive has got you covered. Start exploring today and take your JSON skills to the next level

Extract fields from Json using Kusto in Application Insights

I have the following json contained in a particular field in the traces.customDimensions:

enter image description here

When I parse this Json to extract a particular value I always get an empty column, for example:

traces | order by timestamp desc
| project CurrentContext = parse_json(customDimensions.CurrentPluginContext)
| extend Source = CurrentContext.source
| project Source

The query returns the following:

enter image description here

I’ve also tried:

traces | order by timestamp desc
| project timestamp, CurrentContext = customDimensions.CurrentPluginContext, CurrentParentContext = customDimensions.CurrentParentluginContext,
Source = parse_json(tostring(customDimensions.CurrentPluginContext)).source,
DepthCurrentContext = parse_json(tostring(customDimensions.CurrentPluginContext)).depth,
DepthCurrentParentContext = parse_json(tostring(customDimensions.CurrentParentluginContext)).depth
| mv-expand CurrentContext
| extend Source = CurrentContext.source

But here I get also an empty "Source" column. And the Columns "DepthCurrentContext" and "DepthCurrentParentContext" do not even appear.

enter image description here

The Json is valid.

Do I miss something here?

Any help is very appreciated!

UPDATE 27.02.2023

When I do the following:

let json = '{"source": "GetUserData","correlationId": "00000000-0000-0000-0000-000000000000","depth": "1","initiatingUserId": "00000000-0000-0000-0000-000000000000","isInTransaction": "False","isolationMode": "2","message": "Update","mode": "Asynchronus","operationId": "00000000-0000-0000-0000-000000000000","orgId": "00000000-0000-0000-0000-000000000000","orgName": "unqXXXXXXXXXXXXXXXXXXXX","requestId": "00000000-0000-0000-0000-000000000000","userId": "00000000-0000-0000-0000-000000000000","entityId": "00000000-0000-0000-0000-000000000000","entityName": "systemuser","type": "Plugin","stage": "Post-operation"}';

traces
| extend properties = parse_json(json)
| project Source = properties.source, CorrelationID = properties.correlationId

I get the properties out of the Json. The Json is the exact same as the ohne from the log.

Any idea?

Tags:

2

Answers


  1. 0 
    traces | order by timestamp desc
| project CurrentContext = parse_json(customDimensions.CurrentPluginContext)
| extend Source = parse_json(tostring(CurrentContext)).source
| project Source
    Login or Signup to reply.
  2. 0

    as mentioned in the documentation: you will need to use tostring on the internal property bag.

    i.e. parse_json(tostring(parse_json(customDimensions).CurrentPluginContext))

    enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search