Azure Data Explorer, Kusto: Replace regex question

user_3110970 0
Viewed 569

According to documentation we can use replace_regex() to make complex replace in strings. I want to change first letter in json-field key to lower case. This is how my code looks like

let example = @'{"Id":"00000","Categories":[{"Position":208, "CategoryId":"XXX"}]}';
print(replace("\"([^\"]+?)\"\\s*:", @'\l\1', example))

It does not work because I cant' do anything meaningful in replacement pattern.

replace("\"([^\"]+?)\"\\s*:", tolower(@'\0'), example)

or

replace("\"([^\"]+?)\"\\s*:", (@'tolower(\0)'), example)

don't work either.

rewrite: The replacement regex for any match made by matchingRegex. Use \0 to refer to the whole match, \1 for the first capture group, \2 and so on for subsequent capture groups.

Can we use matches (\0, \1, \2) more than just concatenating as in example?

kql azure-data-explorer regex
1 Answers

This is not quite possible to do with regex. A partial solution (that changes 1st-level keys) can be done with the following query:

let example = parse_json(@'{"Id":"00000","Categories":[{"Position":208, "CategoryId":"XXX"}]}');
print x=example
| mv-apply kvp = example on
(
    mv-expand kind=array kvp
    | project k = tolower(kvp[0]), v=kvp[1]
    | summarize x=make_bag(pack(k, v))
)
user_101517940
Related