0

I am unable to get the desired results using a $expand and $filter in Odata on a REST API GET call. Basically looking to filter results so only properties.status = 'Closed' are returned on the GET API call. So far the expand and filters receive 200 OK but are not honoring the filtering in the body results.

https://management.azure.com/subscriptions/{SUBID}/resourceGroups/{RGNAME}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/providers/Microsoft.SecurityInsights/Cases?api-version=2019-01-01-preview&$expand=properties($filter=status eq 'Closed')

results

eventually adding a 2nd filter like:

&$expand=properties($filter=status eq 'Closed' and relatedalertproductnames eq 'Azure Security Center')

Gaurav Mantri
  • 128,066
  • 12
  • 206
  • 241
Nathan Swift
  • 1

3 Answers3

0

I believe you're specifying the $filter criteria incorrectly. Please try something like the following:

$expand=properties&$filter=properties/status eq 'New'
Gaurav Mantri
  • 128,066
  • 12
  • 206
  • 241
0

I found the following to work as the values were not in an array but an object.

&$filter=(properties/status eq 'Closed')

Nathan Swift
  • 1
0

Add a plus sign so it takes it as one query

e.g. &$expand=..&$select=..+$filter=...

Anish Kutti
  • 337
  • 2
  • 7