How to list all json key from LogEntry in azure KQL

Question

I'm using azure log analytics workspace for crating azure monitoring workbooks.

Here is one parameter I have to create which will present All json key from LogEntry.

e.g. screenshot

LogEntry has details of @metadata, @timestamp and other keys.

Which operator I should use for getting all Json key under LogEntry.

I try below steps but there is no such a sub module it's showing.

ContainerLog | project LogEntry | evaluate bag_unpack(LogEntry)

I was reffering link but this parameters is not working in log analytics.

Answer 1

Although not mentioned in the blog you referenced, the bag_unpack plugin can be used in Azure Application Insights Workbooks as well.

However, I'm afraid it won't work on the table in question, the reason being, bag_unpack(column) expects the column argument to be a reference to a dynamic column, whereas the LogEntry column in ContainerLog table is of type string.

References:

• https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/bag-unpackplugin
• https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/containerlog