string 解释为 JSON 值并以 dynamic 形式返回值。Interprets a string as a JSON value and returns the value as dynamic.

当需要提取 JSON 复合对象的多个元素时,使用此函数比使用 extractjson() function 函数更好。This function is better than extractjson() function when you need to extract more than one element of a JSON compound object.





  • json:string 类型的表达式。json: An expression of type string. 它表示 JSON 格式的值dynamic 类型的表达式(表示实际的 dynamic 值)。It represents a JSON-formatted value, or an expression of type dynamic, representing the actual dynamic value.


dynamic 类型的对象,该对象由 json 的值确定:An object of type dynamic that is determined by the value of json:

  • 如果 json 的类型为 dynamic,则其值将按原样使用。If json is of type dynamic, its value is used as-is.
  • 如果 json 的类型为 string,并且是格式正确的 JSON 字符串,则系统会分析字符串并返回生成的值。If json is of type string, and is a properly formatted JSON string, then the string is parsed, and the value produced is returned.
  • 如果 json 的类型为 string,但不是格式正确的 JSON 字符串,则返回的值是包含原始 string 值的类型为 dynamic 的对象。If json is of type string, but it isn't a properly formatted JSON string, then the returned value is an object of type dynamic that holds the original string value.


在以下示例中,如果 context_custom_metrics 是类似如下的 stringIn the following example, when context_custom_metrics is a string that looks like this:


则以下 CSL 片段会检索对象中 duration 槽的值,并从中检索两个槽:duration.valueduration.min(分别为 118.0110.0)。then the following CSL Fragment retrieves the value of the duration slot in the object, and from that it retrieves two slots, duration.value and duration.min (118.0 and 110.0, respectively).

| extend d=parse_json(context_custom_metrics) 
| extend duration_value=d.duration.value, duration_min=d["duration"]["min"]


通常用一个 JSON 字符串来描述属性包,其中的一个“槽”是另一个 JSON 字符串。It's common to have a JSON string describing a property bag in which one of the "slots" is another JSON string.

例如:For example:

let d='{"a":123, "b":"{\\"c\\":456}"}';
print d

在这种情况下,不仅需要调用 parse_json 两次,而且还需要确保在第二次调用中使用 tostringIn such cases, it isn't only necessary to invoke parse_json twice, but also to make sure that in the second call, tostring is used. 否则,对 parse_json 的第二次调用会只按原样将输入传递到输出,因为它的已声明类型为 dynamicOtherwise, the second call to parse_json will just pass on the input to the output as-is, because its declared type is dynamic.

let d='{"a":123, "b":"{\\"c\\":456}"}';
print d_b_c=parse_json(tostring(parse_json(d).b)).c