Reputation: 186
I want to read values of a json (message) object which has array in it.
This below query helps for immediate properties in d.
traces | extend d = parsejson(message) | d.Timestamp, d.Name;
How do I read property part of an array within d (message). For example if I want to read all street values in below message .. how to do ? This is kind of needing a loop
message
{
"Timestamp": "12-12-2008",
Name: "Alex",
address: {
[{"street": "",zip:""},{"street":"", "zip":""}]
}
}
Upvotes: 0
Views: 552
Reputation: 862
One way to do this would be using the mvexpand
operator (see documentation).
It will output a single row for each element in your array which you could iterate over.
So in your example, running:
traces | extend d = parsejson(message) | mvexpand d.address
Will output a row for each address.
Upvotes: 1