bag_pack()

适用于:✅Azure 数据资源管理器Azure MonitorMicrosoft Sentinel

根据键和值的列表创建一个 dynamic 属性包对象。

已弃用的别名:pack ()、pack_dictionary ()

语法

bag_pack(key1, value1, key2, value2,... )

详细了解语法约定

参数

客户 类型​​ 必需 说明
string ✔️ 键名称。
value 任何标量数据类型 ✔️ 键值。

注意

键和值字符串是一个交替列表,列表的总长度必须是偶数。

返回

根据列出的键和值输入返回一个 dynamic 属性包对象。

示例

示例 1

以下示例从键和值的交替列表创建并返回属性包。

print bag_pack("Level", "Information", "ProcessID", 1234, "Data", bag_pack("url", "www.bing.com"))

结果

print_0
{"Level":"Information","ProcessID":1234,"Data":{"url":"www.bing.com"}}

示例 2

以下示例创建了一个属性包,并使用“.”操作符从属性包中提取值。

datatable (
    Source: int,
    Destination: int,
    Message: string
) [
    1234, 100, "AA", 
    4567, 200, "BB",
    1212, 300, "CC" 
]
| extend MyBag=bag_pack("Dest", Destination, "Mesg", Message)
| project-away Source, Destination, Message
| extend MyBag_Dest=MyBag.Dest, MyBag_Mesg=MyBag.Mesg

结果

MyBag MyBag_Dest MyBag_Mesg
{"Dest":100,"Mesg":"AA"} 100 AA
{"Dest":200,"Mesg":"BB"} 200 BB
{"Dest":300,"Mesg":"CC"} 300 CC

示例 3

以下示例使用两个表,SmsMessages 和 MmsMessages,并从其他列返回其公用列和属性包。 表是作为查询的一部分临时创建的。

SmsMessages

SourceNumber TargetNumber CharsCount
555-555-1234 555-555-1212 46
555-555-1234 555-555-1213 50
555-555-1212 555-555-1234 32

MmsMessages

SourceNumber TargetNumber AttachmentSize AttachmentType AttachmentName
555-555-1212 555-555-1213 200 jpeg Pic1
555-555-1234 555-555-1212 250 jpeg Pic2
555-555-1234 555-555-1213 300 png Pic3
let SmsMessages = datatable (
    SourceNumber: string,
    TargetNumber: string,
    CharsCount: string
) [
    "555-555-1234", "555-555-1212", "46", 
    "555-555-1234", "555-555-1213", "50",
    "555-555-1212", "555-555-1234", "32" 
];
let MmsMessages = datatable (
    SourceNumber: string,
    TargetNumber: string,
    AttachmentSize: string,
    AttachmentType: string,
    AttachmentName: string
) [
    "555-555-1212", "555-555-1213", "200", "jpeg", "Pic1",
    "555-555-1234", "555-555-1212", "250", "jpeg", "Pic2",
    "555-555-1234", "555-555-1213", "300", "png", "Pic3"
];
SmsMessages 
| join kind=inner MmsMessages on SourceNumber
| extend Packed=bag_pack("CharsCount", CharsCount, "AttachmentSize", AttachmentSize, "AttachmentType", AttachmentType, "AttachmentName", AttachmentName) 
| where SourceNumber == "555-555-1234"
| project SourceNumber, TargetNumber, Packed

结果

SourceNumber TargetNumber Packed
555-555-1234 555-555-1213 {"CharsCount":"50","AttachmentSize":"250","AttachmentType":"jpeg","AttachmentName":"Pic2"}
555-555-1234 555-555-1212 {"CharsCount":"46","AttachmentSize":"250","AttachmentType":"jpeg","AttachmentName":"Pic2"}
555-555-1234 555-555-1213 {"CharsCount":"50","AttachmentSize":"300","AttachmentType":"png","AttachmentName":"Pic3"}
555-555-1234 555-555-1212 {"CharsCount":"46","AttachmentSize":"300","AttachmentType":"png","AttachmentName":"Pic3"}