extractjson()extractjson()
使用路径表达式获取 JSON 文本外指定的元素。Get a specified element out of a JSON text using a path expression.
(可选)将提取的字符串转换为特定类型。Optionally convert the extracted string to a specific type.
extractjson("$.hosts[1].AvailableMB", EventText, typeof(int))
语法Syntax
extractjson(
jsonPath,
dataSource)
extractjson(
jsonPath,
dataSource)
参数Arguments
- jsonPath:在 JSON 文档中定义访问器的 JsonPath 字符串。jsonPath : JsonPath string that defines an accessor into the JSON document.
- dataSource:JSON 文档。dataSource : A JSON document.
返回Returns
此函数对 dataSource(内含有效的 JSON 字符串)执行 JsonPath 查询,从而可选择根据第三个参数将该值转换为其他类型。This function performs a JsonPath query into dataSource which contains a valid JSON string, optionally converting that value to another type depending on the third argument.
示例Example
[
方括号]
表示法和点 (.
) 表示法等效:The [
bracket]
notatation and dot (.
) notation are equivalent:
T
| extend AvailableMB = extractjson("$.hosts[1].AvailableMB", EventText, typeof(int))
T
| extend AvailableMD = extractjson("$['hosts'][1]['AvailableMB']", EventText, typeof(int))
JSON 路径表达式JSON Path expressions
路径表达式Path expression | 说明Description |
---|---|
$ |
根对象Root object |
@ |
当前对象Current object |
. 或 [ ] . or [ ] |
子Child |
[ ] |
数组下标Array subscript |
(目前未实现通配符、递归、联合或切片。) (We don't currently implement wildcards, recursion, union, or slices.)
性能提示Performance tips
- 使用
extractjson()
之前应用 where 子句Apply where-clauses before usingextractjson()
- 请考虑改用与 extract 匹配的正则表达式匹配项。Consider using a regular expression match with extract instead. 如果从模板生成 JSON,运行速度则更快并且高效。This can run very much faster, and is effective if the JSON is produced from a template.
- 如果需要从 JSON 提取多个值,请使用
parse_json()
。Useparse_json()
if you need to extract more than one value from the JSON. - 考虑将列类型声明为动态,以便在引入时分析 JSON。Consider having the JSON parsed at ingestion by declaring the type of the column to be dynamic.