azureazure-functionskqlazure-log-analytics-workspace

How to parse the string tye column using kql query


I have the KQL Query that gets the function app logs in Azure Log Analytics Workspace.

The Column Values are like ["[{\"ServiceNamd\":\"user-service\",\""].

This column values are fetched from the other column using split method.

I'm unable to remove special characters from the string. My requirement is to print the column values like Service Name:user-service

FunctionAppLogs
| Where Function Name contains "HealthCheckApI"
| extend ServiceName = trim(@'[["\"]+', Mesage)

I tried the solutions given in SO Q1 and Q2 but unable to get it


Solution

  • I have used the below KQL query and got the expected result

    Functions
    | extend abc = replace_string(Message, '\"', "")
    | extend ServiceName = split(split(abc, '{')[1], ",")[0]
    | project ServiceName
    

    Output:

    enter image description here