CODEWITHSUNDEEP
azure-eventhubazure-data-explorerkql
ashwini prakash
ashwini prakash

Reputation: 145

Log data from Azure Event Hub is ingested to ADX table , no records being displayed but record counts are coming

[https://stackoverflow.com/a/61135904/10009608][1]

I am ingesting log data from Event hub to ADX table , there are no ingestion error but the records dont display in the ADX Table. I checked Metrics at ADX and Event Hub , all looks good there. My doubt is i am making some mistake in Json mapping at ADX , please help!. JSON Input log -
{"Result":{"AppId":"VC4RAKOlhdK8sPuK","Id":null,"UserId":"7f471608-a395-46ce-9d57-8503075ce948","Email":"[email protected]","RoleName":"User","Operation":"Login","Params":null},"Id":5,"Exception":null,"Status":5,"IsCanceled":0,"IsCompleted":1,"IsCompletedSuccessfully":1,"CreationOptions":0,"AsyncState":null,"IsFaulted":0,"EventProcessedUtcTime":"2020-04-09T10:39:19.8965009Z","PartitionId":0,"EventEnqueuedUtcTime":"2020-04-09T09:04:30.8100000Z"}

Table Created - 

.create table EventRaw (AppId:string,Id:string,UserId:string,Email:string,RoleName:string,Operation:string,Params:string,EventProcessedUtcTime:datetime,PartitionId:string,EventEnqueuedUtcTime:datetime)

Mapping applied at ADX Table

  .create table EventRaw ingestion json mapping 'Mapping' '[{"column":"AppId", "Properties": {"Path": "$.appid"}},{"column":"Id", "Properties": {"Path": "$.id"}},{"column":"UserId", "Properties": {"Path":"$.userid"}} ,{"column":"Email", "Properties": {"Path":"$.email"}}, {"column":"RoleName", "Properties": {"Path":"$.rolename"}},{"column":"Operation", "Properties": {"Path":"$.operation"}},{"column":"Params", "Properties": {"Path":"$.params"}},{"column":"EventProcessedUtcTime", "Properties": {"Path":"$.eventprocessedutctime"}},{"column":"PartitionId", "Properties": {"Path":"$.partitionid"}},{"column":"EventEnqueuedUtcTime", "Properties": {"Path":"$.eventenqueuedUtctime"}}]'

Your help is much appreciated!

Upvotes: 0

Views: 485

Answers (1)

Avnera
Avnera

Reputation: 7618

The 'Path' in the json mapping is case sensitive, and I see that your mapping is using different casing, for example the json property Email is mapped as "Path":"$.email" it should be "Path":"$.Email"

Upvotes: 2

Related Questions