JSONPath expressions
JSONPath notation describes the path to one or more elements in a JSON document.
The JSONPath notation is used in the following scenarios:
- To specify data mappings for ingestion
- To specify data mappings for external tables
- In KQL functions that process dynamic objects, like bag_remove_keys() and extractjson()
The following subset of the JSONPath notation is supported:
| Path expression | Description |
|---|---|
$ |
Root object |
. |
Selects the specified property in a parent object. Use this notation if the property doesn't contain special characters. |
['property'] or ["property"] |
Selects the specified property in a parent object. Make sure you put single quotes or double quotes around the property name. Use this notation if the property name contains special characters, such as spaces, or begins with a character other than A..Za..z_. |
[n] |
Selects the n-th element from an array. Indexes are 0-based. |
Note
Wildcards, recursion, union, slices, and current object are not supported.