buildschema() (aggregation function)

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Builds the minimal schema that admits all values of DynamicExpr.

buildschema (DynamicExpr)

Learn more about syntax conventions.

Returns the minimal schema that admits all values of DynamicExpr.

The following example builds a schema based on:

• {"x":1, "y":3.5}
• {"x":"somevalue", "z":[1, 2, 3]}
• {"y":{"w":"zzz"}, "t":["aa", "bb"], "z":["foo"]}

datatable(value: dynamic) [
    dynamic({"x":1, "y":3.5}),
    dynamic({"x":"somevalue", "z":[1, 2, 3]}),
    dynamic({"y":{"w":"zzz"}, "t":["aa", "bb"], "z":["foo"]})
]
| summarize buildschema(value)

Results

The resulting schema tells us that:

• The root object is a container with four properties named x, y, z, and t.
• The property called x is of type long or of type string.
• The property called y ii of type double, or another container with a property called w of type string.
• The indexer keyword indicates that z and t are arrays.
• Each item in the array z is of type long or of type string.
• t is an array of strings.
• Every property is implicitly optional, and any array may be empty.

The syntax of the returned schema is:

Container ::= '{' Named-type* '}'; Named-type: := (name | '"indexer"') ':' Type; Type ::= Primitive-type | Union-type | Container; Union-type ::= '[' Type* ']'; Primitive-type ::= "long" | "string" | ...;

The values are equivalent to a subset of TypeScript type annotations, encoded as a Kusto dynamic value. In TypeScript, the example schema would be:

var someobject:
{
    x?: (number | string),
    y?: (number | { w?: string}),
    z?: { [n:number] : (long | string)},
    t?: { [n:number]: string }
}