Calling a function and returning a value from datatable

Question

I have some data in Application Insights logs. I am pulling back a number of items - one of which is an ID field. I would like to convert this ID field into a 'friendly name'.

For example:

ex1579 will mean nothing (but this is what is in my data). Instead ex1579 = Microsoft, and ex1580 = IBM. (I have hundreds of these).

I have created a function - that looks like this: (I am not sure if I am attacking this the best way)

let exMapping = datatable(id: string, company: string)[
"ex1579", 'Microsoft',
"ex1580", "IBM"
]

In my kql and I have many - I don't want to have to individually create CASE statements (which I know will work) - as this data will continually change.... and as opposed to updating multiple KQLs - I just want to maintain one datatable.

Going back to my KQL now - when I am returning ex1579 or ex1580 for example; instead of returning these values; I want to instead return (in this case) - Microsoft and IBM.

What is the best approach for this?

Answer 1

You can use a dictionary

Unlike Log Analytics, it seems that Application Insights doesn't currently supports function's parameters, so our function will return the entire dictionary and we will pick a specific key as part of our query.

This would be the function definition:

dynamic({"ex1579":'Microsoft', "ex1580":"IBM"})

This is how it can be used:

print id = "ex1579"
| extend company = getCompany()[id]