Is below the best way to index into an array-of-arrays-of-strings like what is output from the extract_all() function?
I am after the most terse and direct expression-isolated way to refer to the match[0][0] and match0 values, w/o any side-affects like temp columns from mvexpand.
I feel like there is something easy I am missing to do this.
print x="match first foo and bar, but not another foo and bar"
// extract_all(...) output is dynamic([string]), so 'match' is dynamic([string]) and 'match[0]' is dynamic(string)
// but ... it really is an array-of-arrays for multiple occurrences of multiple capture groups like 'match'.
// how do I index the array within match[0] without reparsing it all via parse_json?
| extend match = extract_all("(foo) and (bar)", x)
| extend first_occurence = match[0]
// I seem to need to do this to get the capture group values, since 'first_occurence' is dynamic(string)
// notes: not using mvexpand on purpose, I want to do this as an expression on the isolated function output; I do not want
// to create temp columns just to hold intermediate values
| extend first_occurence_captures = parse_json(tostring(first_occurence))
| extend myfoo = first_occurence_captures[0]
| extend mybar = first_occurence_captures[1]
The output:
UPDATE: I tried match[0][0] despite the syntax error shown in the Kusto desktop UI. So maybe the real issues is that there is a false syntax error that dissuaded me from trying it.
Here is what I see in my Kusto.Explorer [v1.0.3.1276]
But the output as expected works:
I have reproduced in my environment and below are expected results:
I tried match[0][0] despite the syntax error shown in the Kusto desktop UI. So maybe the real issues is that there is a false syntax error that dissuaded me from trying it.
Kql interpreter does not expect []
at that situation, but nested array is available in kql but when we run the query, it compiles successfully and gives us the output like below:
print x ="match first foo and bar, but not in another c foo and bar"
| extend match = extract_all("(foo) and (bar)", x)
| extend foo = match[0][0] , bar =match[0][1]
Output:
It is an expected behavior in Kql, If you want to investigate on this further, I would suggest you to open a support ticket on this for further clarification.