Azure Analytics Log FunctionAppLogs extract JSON fields into columns

Question

I would like to extract the JSON fields into columns for Message:

FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState" 
| where Message has "Telemetry Message"
| where TimeGenerated > datetime(2022-11-25 06:38) and TimeGenerated < datetime(2022-11-25 06:50)

I try adding ADFPipelineRun query code I found to select the columns but I get no results (blank and no errors):

FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState" 
| where Message has "Telemetry Message"
| where TimeGenerated > datetime(2022-11-25 06:38) and TimeGenerated < datetime(2022-11-25 06:50)
| extend MessageObject=parse_json(Message)
| mv-expand MessageObject
| extend myhumidity=MessageObject.humidity
| project myhumidity

score 0 · Accepted Answer · answered Nov 25 '22 at 15:24

In case it helps anyone, the problem was that I was sending text along json - notice "Telemetry Message:{...".

I tried substring but the result wasn't recognized by Kusto as json. I changed the logs to show json without any text and the final query that worked was:

FunctionAppLogs
| order by TimeGenerated desc
| where FunctionName == "TelemetryListenerCalculateAlgoPostNewState" 
| where Message has "telemetryTimeStamp"
| where TimeGenerated > datetime(2022-11-25 14:50) and TimeGenerated < datetime(2022-11-25 15:00)
| extend MessageObject=parse_json(Message)
| extend mxchip_timestamp=MessageObject.telemetryTimeStamp
| extend humidity=MessageObject.humidity
| project TimeGenerated, mxchip_timestamp, humidity

Azure Analytics Log FunctionAppLogs extract JSON fields into columns

1 Answers1