How to find an item in a json array using kusto

Question

I have an json array logged as

[
  {
    "Key": "key0",
    "Value": 0
  },
  {
    "Key": "key1",
    "Value": 2
  }
]

How do I get Value for Key with value key0, so 0.

I have been using this kluge.

...
| extend jsonarray = parse_json(...)
| extend value = toint(case(
    jsonarray[0].Key == 'key0', jsonarray[0].Value,
    jsonarray[1].Key == 'key0', jsonarray[1].Value,
    "<out-of-range>"))

Update:

Using mv-apply:

| extend jsonarray = parse_json(...)
| mv-apply jsonarray on (
    where jsonarray.Key == 'key0'
    | project value = toint(jsonarray.Value)
    )

Yoni L. · Accepted Answer · 2019-12-17 15:37:57Z

3

you could use mv-expand or mv-apply:

print d = dynamic([
  {
    "Key": "key0",
    "Value": 0
  },
  {
    "Key": "key1",
    "Value": 2
  }
])
| mv-apply d on (
    where d.Key == "key0"
    | project d.Value
)

answered Dec 17, 2019 at 15:37

Yoni L.

26.5k3 gold badges46 silver badges63 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

hIpPy Over a year ago

How about when there are multiple rows? Each row has that json array.

Yoni L. Over a year ago

generally speaking - it'd be very similar. you may want to consider providing a sample input (as done above), but also - your desired output - that may help in giving you an answer you'd be happy with

Collectives™ on Stack Overflow

How to find an item in a json array using kusto

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related