make_bag_if()(聚合函数)make_bag_if() (aggregation function)

返回组中“Expr”的所有值的 dynamic (JSON) 属性包(字典),其 Predicate 的计算结果为 trueReturns a dynamic (JSON) property-bag (dictionary) of all the values of 'Expr' in the group, for which Predicate evaluates to true.

备注

只能在 summarize 内的聚合上下文中使用。Can only be used in context of aggregation inside summarize.

语法Syntax

summarize make_bag_if(Expr, Predicate [, MaxSize])summarize make_bag_if(Expr, Predicate [, MaxSize])

参数Arguments

  • Expr:将用于聚合计算的 dynamic 类型的表达式。Expr: Expression of type dynamic that will be used for aggregation calculation.
  • 谓词:必须计算为 true 的谓词,用于将“Expr”添加到结果中。Predicate: Predicate that has to evaluate to true, in order for 'Expr' to be added to the result.
  • MaxSize:对返回元素最大数目的可选整数限制(默认值是 1048576)。MaxSize: An optional integer limit on the maximum number of elements returned (default is 1048576). MaxSize 值不能超过 1048576。MaxSize value can't exceed 1048576.

返回Returns

返回组中“Expr”的所有值(属性包(字典))的 dynamic (JSON) 属性包(字典),其 Predicate 的计算结果为 trueReturns a dynamic (JSON) property-bag (dictionary) of all the values of 'Expr' in the group that are property-bags (dictionaries), for which Predicate evaluates to true. 将跳过非字典值。Non-dictionary values will be skipped. 如果一个键出现在多个行中,则会从此键的可能值中选择一个任意值。If a key appears in more than one row, an arbitrary value, out of the possible values for this key, will be selected.

备注

make_bag 函数类似于不带谓词表达式的 make_bag_if()。The make_bag function, is similar to make_bag_if() without predicate expression.

示例Examples

let T = datatable(prop:string, value:string, predicate:bool)
[
    "prop01", "val_a", true,
    "prop02", "val_b", false,
    "prop03", "val_c", true
];
T
| extend p = pack(prop, value)
| summarize dict=make_bag_if(p, predicate)

dictdict
{ "prop01": "val_a", "prop03": "val_c" }{ "prop01": "val_a", "prop03": "val_c" }

使用 bag_unpack() 插件将 make_bag_if() 输出中的包键转换为列。Use bag_unpack() plugin for transforming the bag keys in the make_bag_if() output into columns.

let T = datatable(prop:string, value:string, predicate:bool)
[
    "prop01", "val_a", true,
    "prop02", "val_b", false,
    "prop03", "val_c", true
];
T
| extend p = pack(prop, value)
| summarize bag=make_bag_if(p, predicate)
| evaluate bag_unpack(bag)

prop01prop01 prop03prop03
val_aval_a val_cval_c