azure-data-explorer - How to find an item in a json array using kusto

Question

I have an json array logged as

[
  {
    "Key": "key0",
    "Value": 0
  },
  {
    "Key": "key1",
    "Value": 2
  }
]

How do I get Value for Key with value key0, so 0.

I have been using this kluge.

...
| extend jsonarray = parse_json(...)
| extend value = toint(case(
    jsonarray[0].Key == 'key0', jsonarray[0].Value,
    jsonarray[1].Key == 'key0', jsonarray[1].Value,
    "<out-of-range>"))

Update:

Using mv-apply:

| extend jsonarray = parse_json(...)
| mv-apply jsonarray on (
    where jsonarray.Key == 'key0'
    | project value = toint(jsonarray.Value)
    )

Answer 1

you could use mv-expand or mv-apply:

print d = dynamic([
  {
    "Key": "key0",
    "Value": 0
  },
  {
    "Key": "key1",
    "Value": 2
  }
])
| mv-apply d on (
    where d.Key == "key0"
    | project d.Value
)

• https://docs.microsoft.com/en-us/azure/kusto/query/mvexpandoperator
• https://docs.microsoft.com/en-us/azure/kusto/query/mv-applyoperator