问题描述
我有一个kusto表,其中一列是带有嵌套json的动态类型, 如何在Kusto中展平? mv-expand只做一个级别。
column1 : timetsamp
column2 : id
column3 : json object
timestamp id value
2020-10-13 22:42:05.0000000 d0 "{
""value"": ""0"",""max"": ""0"",""min"": ""0"",""avg"": ""0""
}"
2020-10-13 22:42:05.0000000 d0 "{
""sid"": ""a0"",""data"": {
""x"": {
""a"": {
""t1"": ""2020-10-13T22:46:50.1310000Z"",""m1"": 446164,""m4"": {
""m41"": ""abcd"",""m42"": 1234
}
}
}
}
}"
#update2:我可以调低键,但不能调低值
let testJson = datatable(timestamp : datetime,id : string,value : dynamic )
[datetime(2020-10-13T22:42:05Z),'d0',dynamic({"value":"0","max":"0","min":"0","avg":"0"}),datetime(2020-10-13T22:42:05Z),'d1',dynamic({"sid":"a0","data":{"x":{"a":{"t1":"2020-10-13T22:46:50.131Z","m1":446164,"m4":{"m41":"abcd","m42":1234}}}}})];
testJson
| extend key=treepath(value)
| mv-expand key
| extend value1 = value[tostring(key)]
解决方法
您可以多次调用mv-expand:
let _data = datatable (column1:datetime,column2:string,column3:dynamic )
[
datetime(2020-10-13 22:42:05.0000000),'d0',dynamic({
"value": "0","max": "0","min": "0","avg": "0"
}),datetime(2020-10-13 22:42:05.0000000),dynamic({
"sid": "a0","data": {
"x": {
"a": {
"t1": "2020-10-13T22:46:50.1310000Z","m1": 446164,"m4": {
"m41": "abcd","m42": 1234
}
}
}
}
})
];
_data
| mv-expand column3
| mv-expand more_data=column3.data.x.a
| mv-expand more_data_m4=more_data.m4
您还可以使用evaluate bag_unpack()
将动态字段提升为列:
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/bag-unpackplugin
let _data = datatable (column1:datetime,"m42": 1234
}
}
}
}
})
];
_data
| mv-expand column3
| extend expanded_data = column3.data.x.a
| evaluate bag_unpack(expanded_data)