Search code examples
azure-log-analyticsazure-log-analytics-workspace

Azure Analytics Log FunctionAppLogs extract JSON fields into columns


I would like to extract the JSON fields into columns for Message:

FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState" 
| where Message has "Telemetry Message"
| where TimeGenerated > datetime(2022-11-25 06:38) and TimeGenerated < datetime(2022-11-25 06:50)

enter image description here

I try adding ADFPipelineRun query code I found to select the columns but I get no results (blank and no errors):

FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState" 
| where Message has "Telemetry Message"
| where TimeGenerated > datetime(2022-11-25 06:38) and TimeGenerated < datetime(2022-11-25 06:50)
| extend MessageObject=parse_json(Message)
| mv-expand MessageObject
| extend myhumidity=MessageObject.humidity
| project myhumidity

Solution

  • In case it helps anyone, the problem was that I was sending text along json - notice "Telemetry Message:{...".

    I tried substring but the result wasn't recognized by Kusto as json. I changed the logs to show json without any text and the final query that worked was:

    FunctionAppLogs
    | order by TimeGenerated desc
    | where FunctionName == "TelemetryListenerCalculateAlgoPostNewState" 
    | where Message has "telemetryTimeStamp"
    | where TimeGenerated > datetime(2022-11-25 14:50) and TimeGenerated < datetime(2022-11-25 15:00)
    | extend MessageObject=parse_json(Message)
    | extend mxchip_timestamp=MessageObject.telemetryTimeStamp
    | extend humidity=MessageObject.humidity
    | project TimeGenerated, mxchip_timestamp, humidity