Search/replace in Kusto

Question

Use case: Remove a string from Azure Application Insights results

This is a simple question but with minimal examples online and as a new user, and with limited experience (but learning) in Regex, I am struggling.

How do I remove all instances of | Articles in the following table, which is an example of what I am exporting from Azure Application Insights?

This did not work:

| extend name=replace(@' | Articles', @'', name)

I have fiddled quite a bit unsuccessfully with an example in Microsoft's documentation (I know this interpretation is incorrect):

| extend str=strcat(' | Articles', tostring(name))
| extend replaced=replace(@' | Articles', @'', str)

Thank you for any insights.

score 3 · Accepted Answer · answered Jun 01 '20 at 21:21

the reason your initial attempt doesn't work is that the first argument to replace() is a regular expression, and if you have the pipe (|) in is, you'll need to properly escape it, using a backslash (\).

for example:

datatable(s:string)
[
    "Article 1 | Articles",
    "Article 2",
    "Article 3 | Articles" 
]
| extend replaced=replace(@' \| Articles', @'', s)

ideally, you'll choose a solution that doesn't require using a regular expression, if possible.

for example:

datatable(s:string)
[
    "Article 1 | Articles",
    "Article 2",
    "Article 3 | Articles" 
]
| extend i = indexof(s, " | Articles")
| project s = case(i == -1, s, substring(s, 0, i))

Search/replace in Kusto

1 Answers1