parse 运算符parse operator

计算字符串表达式并将其值分析为一个或多个计算列。Evaluates a string expression and parses its value into one or more calculated columns. 对于未成功分析的字符串,计算列将具有 null 值。The calculated columns will have nulls, for unsuccessfully parsed strings. 有关详细信息,请参阅 parse-where 运算符For more information, see the parse-where operator.

T | parse Text with "ActivityName=" name ", ActivityType=" type

语法Syntax

T | parse [kind=regex [flags=regex_flags] |simple|relaxed] Expression with * (StringConstant ColumnName [: ColumnType]) *...T | parse [kind=regex [flags=regex_flags] |simple|relaxed] Expression with * (StringConstant ColumnName [: ColumnType]) *...

参数Arguments

  • T:输入表。T: The input table.

  • 种类:kind:

    • simple(默认值):StringConstant 是一个正则字符串值,匹配是严格的。simple (the default): StringConstant is a regular string value and the match is strict. 所有字符串分隔符都应出现在分析的字符串中,并且所有扩展列都必须与所需类型匹配。All string delimiters should appear in the parsed string, and all extended columns must match the required types.

    • regex:StringConstant 可能是正则表达式,匹配是严格的。regex: StringConstant may be a regular expression and the match is strict. 所有字符串分隔符(对于此模式,可以是正则表达式)都应出现在分析的字符串中,并且所有扩展列都必须与所需类型匹配。All string delimiters, which can be a regex for this mode, should appear in the parsed string, and all extended columns must match the required types.

    • flags:要在 regex 模式中使用的标志,例如 U (Ungreedy)、m(多行模式)、s(匹配新行 \n)、i(不区分大小写),详见 RE2 标志flags: Flags to be used in regex mode like U (Ungreedy), m (multi-line mode), s (match new line \n), i (case-insensitive) in RE2 flags.

    • relaxed:StringConstant 是一个正则字符串值,匹配是宽松的。relaxed: StringConstant is a regular string value and the match is relaxed. 所有字符串分隔符都应出现在分析的字符串中,但是扩展列可以部分匹配所需的类型。All string delimiters should appear in the parsed string, but extended columns may partially match the required types. 与所需类型不匹配的扩展列将获得 null 值。Extended columns that didn't match the required types will get the value null.

  • 表达式:计算结果为字符串的表达式。Expression: An expression that evaluates to a string.

  • ColumnName:要为其赋值的列的名称(从字符串表达式中提取)。ColumnName: The name of a column to assign a value to, extracted from the string expression.

  • ColumnType:可选。ColumnType: Optional. 一个标量值,指示要将值转换为何种类型。The scalar value that indicates the type to convert the value to. 默认值是 string 类型。The default is the string type.

返回Returns

输入表,根据提供给运算符的列的列表进行扩展。The input table, extended according to the list of columns that are provided to the operator.

提示Tips

  • 如果还希望删除或重命名某些列,请使用 projectUse project if you also want to drop or rename some columns.

  • 在模式中使用 * 可跳过垃圾值。Use * in the pattern, to skip junk values.

    备注

    不能在 string 类型列后使用 *The * can't be used after a string type column.

  • 分析模式不仅能够以 StringConstant 开头,还能够以 ColumnName 开头。The parse pattern may start with ColumnName and not only with StringConstant.

  • 如果分析的表达式不是 string 类型,则会将其转换为 string 类型。If the parsed Expression isn't of type string, it will be converted to type string.

  • 如果使用 regex 模式,则可以通过添加 regex 标志来控制分析中使用的整个正则表达式。If regex mode is used, there's an option to add regex flags to control the entire regex that is used in the parse.

  • 在 regex 模式下,分析会将模式转换为正则表达式。In regex mode, parse will translate the pattern to a regex. 请使用 RE2 语法进行匹配,并使用在内部处理的带编号的已捕获组。Use RE2 syntax to do the matching, and use numbered captured groups that are handled internally. 例如:For example:

    parse kind=regex Col with * <regex1> var1:string <regex2> var2:long
    

    在 parse 语句中,将由分析在内部生成的正则表达式是 .*?<regex1>(.*?)<regex2>(\-\d+)In the parse statement, the regex that will be internally generated by the parse is .*?<regex1>(.*?)<regex2>(\-\d+).

    • * 转换为 .*?* was translated to .*?.

    • string 转换为 .*?string was translated to .*?.

    • long 转换为 \-\d+long was translated to \-\d+.

示例Examples

parse 运算符提供了一种简单的方法,可通过对同一 string 表达式使用多个 extract 应用程序来 extend 表。The parse operator provides a streamlined way to extend a table by using multiple extract applications on the same string expression. 当表中有一个 string 列,其中包含多个要分解为单独列的值时,此结果非常有用。This result is useful, when the table has a string column that contains several values that you want to break into individual columns. 例如,由开发人员 trace ("printf"/"Console.WriteLine") 语句生成的列。For example, a column that was produced by a developer trace ("printf"/"Console.WriteLine") statement.

在下面的示例中,假定 Traces 表的 EventText 列包含 Event: NotifySliceRelease (resourceName={0}, totalSlices= {1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5}) 格式的字符串。In the example below, assume that the column EventText of table Traces contains strings of the form Event: NotifySliceRelease (resourceName={0}, totalSlices= {1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5}). 此操作将用六个列来扩展表:resourceNametotalSlicessliceNumberlockTime releaseTimepreviousLockTimeMonthDayThe operation will extend the table with six columns: resourceName, totalSlices, sliceNumber, lockTime , releaseTime, previousLockTime, Month, and Day.

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices:long * "sliceNumber=" sliceNumber:long * "lockTime=" lockTime ", releaseTime=" releaseTime:date "," * "previousLockTime=" previousLockTime:date ")" *  
| project resourceName ,totalSlices , sliceNumber , lockTime , releaseTime , previousLockTime
resourceNameresourceName totalSlicestotalSlices sliceNumbersliceNumber lockTimelockTime releaseTimereleaseTime previousLockTimepreviousLockTime
PipelineSchedulerPipelineScheduler 2727 1515 02/17/2016 08:40:0002/17/2016 08:40:00 2016-02-17 08:40:00.00000002016-02-17 08:40:00.0000000 2016-02-17 08:39:00.00000002016-02-17 08:39:00.0000000
PipelineSchedulerPipelineScheduler 2727 2323 02/17/2016 08:40:0102/17/2016 08:40:01 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 2727 2020 02/17/2016 08:40:0102/17/2016 08:40:01 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 2727 1616 02/17/2016 08:41:0002/17/2016 08:41:00 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:00.00000002016-02-17 08:40:00.0000000
PipelineSchedulerPipelineScheduler 2727 2222 02/17/2016 08:41:0102/17/2016 08:41:01 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000

对于 regex 模式For regex mode

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse kind = regex EventText with "(.*?)[a-zA-Z]*=" resourceName @", totalSlices=\s*\d+\s*.*?sliceNumber=" sliceNumber:long  ".*?(previous)?lockTime=" lockTime ".*?releaseTime=" releaseTime ".*?previousLockTime=" previousLockTime:date "\\)"  
| project resourceName , sliceNumber , lockTime , releaseTime , previousLockTime
resourceNameresourceName sliceNumbersliceNumber lockTimelockTime releaseTimereleaseTime previousLockTimepreviousLockTime
PipelineSchedulerPipelineScheduler 1515 02/17/2016 08:40:00,02/17/2016 08:40:00, 02/17/2016 08:40:00,02/17/2016 08:40:00, 2016-02-17 08:39:00.00000002016-02-17 08:39:00.0000000
PipelineSchedulerPipelineScheduler 2323 02/17/2016 08:40:01,02/17/2016 08:40:01, 02/17/2016 08:40:01,02/17/2016 08:40:01, 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 2020 02/17/2016 08:40:01,02/17/2016 08:40:01, 02/17/2016 08:40:01,02/17/2016 08:40:01, 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 1616 02/17/2016 08:41:00,02/17/2016 08:41:00, 02/17/2016 08:41:00,02/17/2016 08:41:00, 2016-02-17 08:40:00.00000002016-02-17 08:40:00.0000000
PipelineSchedulerPipelineScheduler 2222 02/17/2016 08:41:01,02/17/2016 08:41:01, 02/17/2016 08:41:00,02/17/2016 08:41:00, 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000

对于使用 regex 标志的 regex 模式For regex mode using regex flags

如果你只想获取 resourceName,请使用以下查询:If you're interested in getting the resourceName only, use this query:

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind = regex  EventText with * "resourceName=" resourceName ',' *
| project resourceName
resourceNameresourceName
PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01
PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00
PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01
PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00
PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00

由于默认模式为 greedy,因此不会获得预期结果。You won't get the expected results, since the default mode is greedy. 如果有一些记录,其中的 resourceName 有时显示为小写,有时显示为大写,则对于某些值,你可能会得到 null。If you have a few records where the resourceName sometimes appears as lower-case and sometimes as upper-case, you may get nulls for some values.

若要获得想要的结果,请采用非 greedy 的 U 标志运行查询,并禁用区分大小写的 i 正则表达式标志。To get the wanted result, run the query with the non-greedy U, and disable case-sensitive i regex flags.

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind = regex flags = Ui EventText with * "RESOURCENAME=" resourceName ',' *
| project resourceName
resourceNameresourceName
PipelineSchedulerPipelineScheduler
PipelineSchedulerPipelineScheduler
PipelineSchedulerPipelineScheduler
PipelineSchedulerPipelineScheduler
PipelineSchedulerPipelineScheduler

如果分析的字符串具有换行符,请使用标志 s 来分析文本。If the parsed string has newlines, use the flag s, to parse the text.

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=23\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=15\nlockTime=02/17/2016 08:40:00\nreleaseTime=02/17/2016 08:40:00\npreviousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=20\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=22\nlockTime=02/17/2016 08:41:01\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=16\nlockTime=02/17/2016 08:41:00\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=s EventText with * "resourceName=" resourceName:string "(.*?)totalSlices=" totalSlices:long "(.*?)lockTime=" lockTime:datetime "(.*?)releaseTime=" releaseTime:datetime "(.*?)previousLockTime=" previousLockTime:datetime "\\)" 
| project-away EventText
resourceNameresourceName totalSlicestotalSlices lockTimelockTime releaseTimereleaseTime previousLockTimepreviousLockTime
PipelineSchedulerPipelineScheduler
2727 2016-02-17 08:40:00.00000002016-02-17 08:40:00.0000000 2016-02-17 08:40:00.00000002016-02-17 08:40:00.0000000 2016-02-17 08:39:00.00000002016-02-17 08:39:00.0000000
PipelineSchedulerPipelineScheduler
2727 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler
2727 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler
2727 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:00.00000002016-02-17 08:40:00.0000000
PipelineSchedulerPipelineScheduler
2727 2016-02-17 08:41:01.00000002016-02-17 08:41:01.0000000 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000

Relaxed 模式Relaxed mode

对于 Relaxed 模式,在此示例中,totalSlices 扩展列必须是 long 类型。In this example for relaxed mode, totalSlices extended column must be of type long. 但是,在分析的字符串中,它的值是 nonValidLongValue。However, in the parsed string, it has the value nonValidLongValue. 在 releaseTime 扩展列中,不能将值 nonValidDateTime 分析为日期/时间。In releaseTime extended column, the value nonValidDateTime can't be parsed as datetime. 这两个扩展列将获得 null 值,而其他扩展列(例如 sliceNumber)仍会获得正确的值。These two extended columns will get the value null while the other ones, such as sliceNumber, still get the correct values.

如果将选项 kind = simple 用于下面的同一查询,则对于所有扩展列,你都会获得 null 值。If you use option kind = simple for the same query below, you'll get null for all extended columns. 此选项在扩展列上是严格的,这是 relaxed 模式和 simple 模式之间的差异。This option is strict on extended columns, and is the difference between relaxed and simple mode.

备注

在 relaxed 模式下,可以对扩展列进行部分匹配。In relaxed mode, extended columns can be partially matched.

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=nonValidDateTime, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=relaxed EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices:long * "sliceNumber=" sliceNumber:long * "lockTime=" lockTime ", releaseTime=" releaseTime:date "," * "previousLockTime=" previousLockTime:date ")" *
| project-away EventText
resourceNameresourceName totalSlicestotalSlices sliceNumbersliceNumber lockTimelockTime releaseTimereleaseTime previousLockTimepreviousLockTime
PipelineSchedulerPipelineScheduler 2727 1515 02/17/2016 08:40:0002/17/2016 08:40:00 2016-02-17 08:39:00.00000002016-02-17 08:39:00.0000000
PipelineSchedulerPipelineScheduler 2727 2323 02/17/2016 08:40:0102/17/2016 08:40:01 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 2020 02/17/2016 08:40:0102/17/2016 08:40:01 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 1616 02/17/2016 08:41:0002/17/2016 08:41:00 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:00.00000002016-02-17 08:40:00.0000000
PipelineSchedulerPipelineScheduler 2727 2222 02/17/2016 08:41:0102/17/2016 08:41:01 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000