使用路径表达式获取 JSON 文本外指定的元素。Get a specified element out of a JSON text using a path expression.

(可选)将提取的字符串转换为特定类型。Optionally convert the extracted string to a specific type.

extractjson("$.hosts[1].AvailableMB", EventText, typeof(int))


extractjson(jsonPath, dataSource)extractjson(jsonPath, dataSource)


  • jsonPath:在 JSON 文档中定义访问器的 JsonPath 字符串。jsonPath : JsonPath string that defines an accessor into the JSON document.
  • dataSource:JSON 文档。dataSource : A JSON document.


此函数对 dataSource(内含有效的 JSON 字符串)执行 JsonPath 查询,从而可选择根据第三个参数将该值转换为其他类型。This function performs a JsonPath query into dataSource which contains a valid JSON string, optionally converting that value to another type depending on the third argument.


[方括号]表示法和点 (.) 表示法等效:The [bracket] notatation and dot (.) notation are equivalent:

| extend AvailableMB = extractjson("$.hosts[1].AvailableMB", EventText, typeof(int)) 

| extend AvailableMD = extractjson("$['hosts'][1]['AvailableMB']", EventText, typeof(int)) 

JSON 路径表达式JSON Path expressions

路径表达式Path expression 说明Description
$ 根对象Root object
@ 当前对象Current object
.[ ]. or [ ] Child
[ ] 数组下标Array subscript

(目前未实现通配符、递归、联合或切片。) (We don't currently implement wildcards, recursion, union, or slices.)

性能提示Performance tips

  • 使用 extractjson() 之前应用 where 子句Apply where-clauses before using extractjson()
  • 请考虑改用与 extract 匹配的正则表达式匹配项。Consider using a regular expression match with extract instead. 如果从模板生成 JSON,运行速度则更快并且高效。This can run very much faster, and is effective if the JSON is produced from a template.
  • 如果需要从 JSON 提取多个值,请使用 parse_json()Use parse_json() if you need to extract more than one value from the JSON.
  • 考虑将列类型声明为动态,以便在引入时分析 JSON。Consider having the JSON parsed at ingestion by declaring the type of the column to be dynamic.