Search code examples
azurekql

How to dynamically get all nested properties from JSON Array object (example VM data disks) in Azure resource graph


I am trying to get all data disks attached to a Azure VM from Azure Resource Graph Query. I am able to get specific data disk by specifying the index( for example properties.storageProfile.dataDisks[0].name for first disk) but but how do I get this dynamically when more than 1 data disks are attached.


Solution

    1. Row per disk
    resources
    | where ['type'] == 'microsoft.compute/virtualmachines' 
    | mv-expand with_itemindex = i properties.storageProfile.dataDisks
    | extend DataDiskName       = properties_storageProfile_dataDisks.name 
            ,DataDiskSizeGB     = properties_storageProfile_dataDisks.diskSizeGB 
            ,DataDiskSizeType   = properties_storageProfile_dataDisks.managedDisk.storageAccountType 
    
    1. Column per disk
    resources
    | where ['type'] == 'microsoft.compute/virtualmachines' 
    | mv-expand with_itemindex=i dataDisk = properties.storageProfile.dataDisks
    | extend dataDisk = pack_array(dataDisk.name, dataDisk.diskSizeGB, dataDisk.managedDisk.storageAccountType)
    | summarize dataDisk0 = anyif(dataDisk, i == 0)
               ,dataDisk1 = anyif(dataDisk, i == 1)
               ,dataDisk2 = anyif(dataDisk, i == 2)
               ,dataDisk3 = anyif(dataDisk, i == 3)
               ,dataDisk4 = anyif(dataDisk, i == 4)
               by id