How do I get a field from json object in Azure Data Explorer

user_18169582 0
Viewed 209

I use this kql to query in Azure : ContainerLog | where LogEntry contains "ReportProcessTime" |project LogEntry

to get the LogEntry like :

2022-05-30 09:00:04.216 INFO 1 --- [io-8080-exec-10] c.t.s.r.s.ReportManagementService : [METRIC] [ReportProcessTime] {"totalProcessingTime":3188,"generatingTime":3188,"tryCount":1,"generatorProcessingTime":15552000000}

and we'd like to get value of the field "totalProcessingTime" ,which is 3188 in order to evaluate the performance.

however we tried with parse_json but not work.

kql azure-data-explorer
1 Answers

Use the parse operator to get the json part

P.S.
Prefer has_cs over contains.
See Query best practices

print LogEntry = '2022-05-30 09:00:04.216 INFO 1 --- [io-8080-exec-10] c.t.s.r.s.ReportManagementService : [METRIC] [ReportProcessTime] {"totalProcessingTime":3188,"generatingTime":3188,"tryCount":1,"generatorProcessingTime":15552000000}'
| where LogEntry has_cs "ReportProcessTime" 
| parse LogEntry with * "[ReportProcessTime] " myjson:dynamic
| extend tolong(myjson.totalProcessingTime)
LogEntry myjson myjson_totalProcessingTime
2022-05-30 09:00:04.216 INFO 1 --- [io-8080-exec-10] c.t.s.r.s.ReportManagementService : [METRIC] [ReportProcessTime] {"totalProcessingTime":3188,"generatingTime":3188,"tryCount":1,"generatorProcessingTime":15552000000} {"totalProcessingTime":3188,"generatingTime":3188,"tryCount":1,"generatorProcessingTime":15552000000} 3188

Fiddle

user_63364790
Related