I would like to extract the JSON fields into columns for Message:
FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState"
| where Message has "Telemetry Message"
| where TimeGenerated > datetime(2022-11-25 06:38) and TimeGenerated < datetime(2022-11-25 06:50)
I try adding ADFPipelineRun query code I found to select the columns but I get no results (blank and no errors):
FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState"
| where Message has "Telemetry Message"
| where TimeGenerated > datetime(2022-11-25 06:38) and TimeGenerated < datetime(2022-11-25 06:50)
| extend MessageObject=parse_json(Message)
| mv-expand MessageObject
| extend myhumidity=MessageObject.humidity
| project myhumidity
In case it helps anyone, the problem was that I was sending text along json - notice "Telemetry Message:{...".
I tried substring but the result wasn't recognized by Kusto as json. I changed the logs to show json without any text and the final query that worked was:
FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState"
| where Message has "telemetryTimeStamp"
| where TimeGenerated > datetime(2022-11-25 14:50) and TimeGenerated < datetime(2022-11-25 15:00)
| extend MessageObject=parse_json(Message)
| extend mxchip_timestamp=MessageObject.telemetryTimeStamp
| extend humidity=MessageObject.humidity
| project TimeGenerated, mxchip_timestamp, humidity