1

I have following property which I need to parse as JSON. I tried to use parse_json() but it does not work

Query

AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write" 
| where ActivityStatus  == "Started"
| where (Properties contains "8e3af657-a8ff-443c-a75c-2fe8c4bcb635") or (Properties contains "b24988ac-6180-42a0-ab88-20f7382dd24c")
| extend request = parse_json(Properties)
| where request.requestbody.Properties.Scope == "/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171"

Raw data which needs to be parsed

{ "requestbody": "{\"Id\":\"992a2739-9bd2-4d04-bc5f-5ed1142b9861\",\"Properties\":{\"PrincipalId\":\"5ac319a4-740b-4f09-9fd3-fce3ce91fedf\",\"RoleDefinitionId\":\"/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635\",\"Scope\":\"/subscriptions/6f5c5be9-a2dd-49c9-bfa1-77d4db790171\"}}" }

4

1 回答 1

3

看看这个页面的底部（也在下面引用），它解释了为什么以下工作（顺便说一句，从效率的角度来看，我已经为你替换 contains了）：has

AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write" 
| where ActivityStatus  == "Started"
| where (Properties has "8e3af657-a8ff-443c-a75c-2fe8c4bcb635") or (Properties has "b24988ac-6180-42a0-ab88-20f7382dd24c")
| extend request = parse_json(tostring(parse_json(Properties).requestbody))
| project request.Properties.Scope

有一个 JSON 字符串描述一个属性包，其中一个“插槽”是另一个 JSON 字符串，这有点常见。

例如： let d='{"a":123, "b":"{\\"c\\":456}"}'; print d

在这种情况下，不仅需要调用 parse_json 两次，而且要确保在第二次调用中使用 tostring。否则，对 parse_json 的第二次调用将简单地将输入按原样传递给输出，因为它声明的类型是动态的：

let d='{"a":123, "b":"{\\"c\\":456}"}'; print d_b_c=parse_json(tostring(parse_json(d).b)).c

于 2019-02-18T19:05:33.410 回答