App insights: Can you concatenate two properties together?

Question

I have a custom event with a json (string) property called EventInfo. Sometimes this property will be larger than the 150 character limit set on event properties, so I have to split it into multiple properties, ie EventInfo0, EventInfo1, ect.

For example (shortened for simplicity) EventInfo0: [{ "label" : "likeButton", "stat], EventInfo1: [us" : "success" }]

I found out how to look at EventInfo as a json in app insights like:

customEvents
 | where name == "people"
 | extend Properties = todynamic(tostring(customDimensions.Properties))
 | extend type=parsejson(Properties.['EventInfo'])
 | mvexpand type
| project type, type.label, type.status]

Is there a way I can concatenate EventInfo0 and EventInfo1 to create the full json string, and query that like above?

Answer 1

According to the documentation, the 150 character limit is on the key, and not on the entire payload. So splitting as you're doing it may not actually be required.

https://learn.microsoft.com/en-us/azure/azure-monitor/app/data-model-event-telemetry#custom-properties

that said, to answer your questions - while it's not efficient to do this at query time, the following could work:

datatable(ei0:string, ei1:string)
[
    '[{ "label" : "likeButton", "stat]', '[us" : "success" }]',
    '[{ "lab]', '[el" : "bar", "hello": "world" }]'
]
| project properties = parse_json(strcat(substring(ei0, 1, strlen(ei0) - 2), substring(ei1, 1, strlen(ei1) - 2)))
| project properties.label

properties_label
----------------
likeButton
bar