kqlazure-log-analyticsazure-monitor

How to create an empty bag in KQL?


I use parse_json to parse a column but I want to make sure that it actually contains something that looks like a JSON and if it doesn't, just assume an empty bag.

This is the line I have, but I can't seem to figure out how to specify an empty bag.

...
| extend Context = todynamic(iif(ContextStr startswith_cs "{" and ContextStr endswith_cs "}", parse_json(ContextStr), {}))

Using {} gives:

Query could not be parsed at '{' on line [4,118]

Token: {
Line: 4
Position: 118

The documentation at https://learn.microsoft.com/en-us/kusto/query/scalar-data-types/dynamic?view=microsoft-fabric#building-dynamic-objects mentions:

bag_pack() creates a property bag from name/value pairs.

pack_array() creates an array from list of values (can be list of columns, for each row it will create an array from the specified columns).

None of these accept zero arguments, though.

I could use parse_json("{}") but that seems hacky to me.


Solution

  • While researching the documentation for this question I came across following example:

    This extension over JSON isn't available when parsing strings (such as when using the parse_json function or when ingesting data), but it enables you to do the following:

    print d=dynamic({"a": datetime(1970-05-11)})

    To parse a string value that follows the JSON encoding rules into a dynamic value, use the parse_json function.

    So I tried dynamic({}) and that worked!

    The solution is to write the line as such:

    | extend Context = todynamic(iif(ContextStr startswith_cs "{" and ContextStr endswith_cs "}", parse_json(ContextStr), dynamic({})))