0

I have a custom event with a json (string) property called EventInfo. Sometimes this property will be larger than the 150 character limit set on event properties, so I have to split it into multiple properties, ie EventInfo0, EventInfo1, ect.

For example (shortened for simplicity) EventInfo0: [{ "label" : "likeButton", "stat], EventInfo1: [us" : "success" }]

I found out how to look at EventInfo as a json in app insights like:

customEvents
 | where name == "people"
 | extend Properties = todynamic(tostring(customDimensions.Properties))
 | extend type=parsejson(Properties.['EventInfo'])
 | mvexpand type
| project type, type.label, type.status]

Is there a way I can concatenate EventInfo0 and EventInfo1 to create the full json string, and query that like above?

Pootyy
  • 23
  • 1
  • 3
  • It's very nice if you can response to the answer below, like it works for you or not. And if it works, you should accept it as answer, as per [this link](https://meta.stackexchange.com/questions/5234/how-does-accepting-an-answer-work?answertab=active#tab-top). – Ivan Glasenberg Nov 04 '20 at 01:19

1 Answers1

0

According to the documentation, the 150 character limit is on the key, and not on the entire payload. So splitting as you're doing it may not actually be required.

https://learn.microsoft.com/en-us/azure/azure-monitor/app/data-model-event-telemetry#custom-properties

enter image description here

that said, to answer your questions - while it's not efficient to do this at query time, the following could work:

datatable(ei0:string, ei1:string)
[
    '[{ "label" : "likeButton", "stat]', '[us" : "success" }]',
    '[{ "lab]', '[el" : "bar", "hello": "world" }]'
]
| project properties = parse_json(strcat(substring(ei0, 1, strlen(ei0) - 2), substring(ei1, 1, strlen(ei1) - 2)))
| project properties.label

properties_label
----------------
likeButton
bar
Yoni L.
  • 22,627
  • 2
  • 29
  • 48