extract_json()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Get a specified element out of a JSON text using a path expression.

Optionally convert the extracted string to a specific type.

The extract_json() and extractjson() functions are equivalent

extract_json(jsonPath, dataSource, type)

Learn more about syntax conventions.

• Apply where-clauses before using extract_json().
• Consider using a regular expression match with extract instead. This can run very much faster, and is effective if the JSON is produced from a template.
• Use parse_json() if you need to extract more than one value from the JSON.
• Consider having the JSON parsed at ingestion by declaring the type of the column to be dynamic.

This function performs a JSONPath query into dataSource, which contains a valid JSON string, optionally converting that value to another type depending on the third argument.

let json = '{"name": "John", "age": 30, "city": "New York"}';
print extract_json("$.name", json, typeof(string));

Output

• extract function
• extract-all function
• parse operator