Search code examples
azure-application-insightsjsonpathkql

Kusto extractjson not working with email address


I am attempting to use the extractjson() method that includes email addresses in the source data (specifically the @ symbol).

let T = datatable(MyString:string)
[
    '{"user@domain.com": {"value":10}, "userdomain.com": { "value": 5}}'
];
T
| project extractjson('$.["user@domain.com"].value', MyString)

This results in a null being returned, changing the JSONPath to '$.["userdomain.com"].value' does return the correct result.

Results

I know the @ sign is a used as the current node in a filter expression, does this need to be escaped when used with KQL?

Just as a side note, I run the same test using nodes 'jsonpath' package and this worked as expected.

const jp = require('jsonpath');
const data = {"user@domain.com": {"value":10}, "name2": { "value": 5}};

console.log(jp.query(data, '$["user@domain.com"].score'));

Solution

  • you can use the parse_json() function instead, and when you don't have to use extract_json():

    print MyString = '{"user@domain.com": {"value":10}, "userdomain.com": { "value": 5}}'
    | project parse_json(MyString)["user@domain.com"].value
    
    MyString_user@domain.com_value
    10

    From the documentation: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/extractjsonfunction

    enter image description here