How can I find a specific element in a dynamic array in KQL?

How can I find a specific element in a dynamic array in KQL?

E.g. I have the json array (i.e. a string) [{"key": "foo", "val": "bar"}, {"key": "a", "val": "b"}] in KQL. Now I want to find out the value of the property val for the objects with the "a" key. It can be at any index, not only at the index 1 as it is in the example above.

I found the array_index_of function. But it does not seem to accept any predicates, it accepts only the index and I don't know the index in my case beforehand.

Are there any means to query the JSON array for an item which satisfies some conditions in KQL?

I tried the mv-expand, but it seems to separate the key from the val:

datatable (b: dynamic)
[
    dynamic({"key": "foo", "val": "bar"}), 
    dynamic({"key": "a", "val": "b"})
]
| mv-expand b

Now I want to find out the value of the property val for the objects with the "a" key.

I have reproduced in my environment and below are expected results:

You can just use bag_unpack() and then get the value of a like below:

datatable (b: dynamic)
[
    dynamic({"key": "foo", "val": "bar"}), 
    dynamic({"key": "a", "val": "b"})
]
|evaluate bag_unpack(b)
| where key contains "a"

Output:

Fiddle.

Do you happen to know, why in my example above does it split one dynamic into two pieces? E.g. the key foo and the val bar end up in different rows.

mv-exapnd divides the dynamic array based on commas "," and new line so it divides like that and this is an expected behavior.