Search code examples
kqladx

How to I expand JSON data in kusto/data explorer that has nested data?


I am trying to ingest JSON array data into Azure data explorer, as per this Microsoft article. (Only the JSON Array section) https://learn.microsoft.com/en-us/azure/data-explorer/ingest-json-formats?tabs=kusto-query-language

I have one table with two columns(messageId,Message) message contain json data and i want to extract this data into different columns. all of the fields from the array are just blank.

enter code here { 'data': { 'type': 'ABC', 'id': '1234567890', 'attributes': { 'event': 'update', 'logged_at': '2021-06-03T15:41:22.000Z', 'heartbeat_id': '12345678', 'gps_valid': True, 'gps': { 'distance_diff': 0.22, 'total_distance': 127.79 }, 'hdop': 12, 'fuel_level': 180.4, 'relative_position': { 'distance': '3', 'country_code': 'Uk' } },`

CODE: AMO | mv-expand data = message.data | extend type = data.type, id = data.id` }


Solution

  • If I understand correctly, there's no property-bag/array you need to expand (using mv-expand), rather you can extend/project the properties of your choice directly, e.g:

    print message = dynamic({
        "data": {
            "type": "ABC",
            "id": "1234567890",
            "attributes": {
                "event": "update",
                "logged_at": "2021-06-03T15:41:22.000Z",
                "heartbeat_id": "12345678",
                "gps_valid": true,
                "gps": {
                    "distance_diff": 0.22,
                    "total_distance": 127.79
                },
                "hdop": 12,
                "fuel_level": 180.4,
                "relative_position": {
                    "distance": "3",
                    "country_code": "Uk"
                }
            }
        }
    })
    | project message.data.id, message.data.type
    
    message_data_id message_data_type
    1234567890 ABC