Search code examples
azure-application-insightsazure-data-explorer

Kusto's `parse_json` doesn't work on custom dimensions


I'm hoping to be able to analyze structured data stored in a custom dimension of a custom telemetry event emitted to application insights, and getting some weird behavior. It seems like the JSON can't be parsed normally, but if I pass it through strcat it is able to parse the json just fine.

customEvents 
| where name == "PbConfigFilterComponentSaved"
| take 1
| project 
    jsonType=gettype(customDimensions.Json), 
    parsedType=gettype(parse_json(customDimensions.Json)), 
    strcatType=gettype(strcat('', customDimensions.Json)),
    strcatParsedType=gettype(parse_json(strcat('', customDimensions.Json)))

Result:

jsonType:         string
parsedType:       string
strcatType:       string
strcatParsedType: dictionary

Is there a better approach to getting parse_json to work on this kind of value?

Update

In case it's in any way relevant, here's the value of customDimensions.Json:

{"filterComponentKey":"CatalystAgeRange","typeKey":"TemporalConstraint","uiConfig":{"name":"Age","displayMode":"Age"},"config":{"dateSelector":"pat.BirthDTS"},"disabledForScenes":false,"disabledForFilters":false}

Solution

    1. Could you please demonstrate a sample record that isn't parsed correctly?
    2. Speculating (before seeing the data): Have you verified the final paragraph here doesn't apply to your case?

    It is somewhat common to have a JSON string describing a property bag in which one of the "slots" is another JSON string. […] In such cases, it is not only necessary to invoke parse_json twice, but also to make sure that in the second call, tostring will be used. Otherwise, the second call to parse_json will simply pass-on the input to the output as-is, because its declared type is dynamic.