bag_remove_keys()

  • Article
  • 09/30/2024

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Removes keys and associated values from a dynamic property bag.

Syntax

bag_remove_keys(bag,keys)

Learn more about syntax conventions.

Parameters

Name Type Required Description
bag dynamic ✔️ The property bag from which to remove keys.
keys dynamic ✔️ List of keys to be removed from the input. The keys are the first level of the property bag. You can specify keys on the nested levels using JSONPath notation. Array indexing isn't supported.

Returns

Returns a dynamic property bag without specified keys and their values.

Examples

Run the query

datatable(input:dynamic)
[
    dynamic({'key1' : 123,     'key2': 'abc'}),
    dynamic({'key1' : 'value', 'key3': 42.0}),
]
| extend result=bag_remove_keys(input, dynamic(['key2', 'key4']))

Output

input result
{
"key1": 123,
"key2": "abc"
}		 {
"key1": 123
}
{
"key1": "value",
"key3": 42.0
}		 {
"key1": "value",
"key3": 42.0
}

Remove inner properties of dynamic values using JSONPath notation

Run the query

datatable(input:dynamic)
[
    dynamic({'key1': 123, 'key2': {'prop1' : 'abc', 'prop2': 'xyz'}, 'key3': [100, 200]}),
]
| extend result=bag_remove_keys(input, dynamic(['$.key2.prop1', 'key3']))

Output

input result
{
"key1": 123,
"key2": {
"prop1": "abc",
"prop2": "xyz"
},
"key3": [
100,
200
]
}		 {
"key1": 123,
"key2": {
"prop2": "xyz"
}
}