1

I needed to parse a string of properties to a JSON object. Here is the input format:

"var1=[val1] & var2=[val2] & var3=[val3] & var4=[val4]"

And the desired output:

{
   "var1": "val1",
   "var2": "val2",
   "var3": "val3",
   "var4": "val4"
}

I have the answer, see below...

2 Answers 2

2

an alternative method would be using extract_all(), then 'converting' the array into a property bad using pack() and make_bag():

print str = "var1=[val1] & var2=[val2] & var3=[val3] & var4=[val4]"
| project Properties = extract_all(@"(?P<key>\w+)?=\[(?P<value>.*?)\]", dynamic(["key","value"]), str)
| mv-apply Properties on (
    summarize make_bag(pack(tostring(Properties[0]), Properties[1]))
)
Sign up to request clarification or add additional context in comments.

1 Comment

that's usually better tested on a real and meaningful data set - you can run both N times against the same data set, then look at resource utilization (CPU, memory) and total duration using .show queries
1

Thanks Ziad Hammoud for providing this cool workaround!

print str = "var1=[val1] & var2=[val2] & var3=[val3] & var4=[val4]"
| extend str = replace("\\] & ", "&", replace("=\\[", "=", str))
| project Properties = parse_urlquery(str)['Query Parameters']
| where Properties.var2== "val2"

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.