Forum Discussion
KQL Syntax Parsing dynamic list of json tuples
Any guidance on how I would go about parsing a dynamic list of tuples within a single event?
The example I have attached is a AWS CloudTrail log event with a dynamic list of Security Group policies. I need to parse the toPort, fromPort, and cidr from each entry. Each log event will have a dynamic number of policies.
The goal was to break these tuplets out into their own rows and a join (inner) to the parent log.
Thank you in advance.
- Hi
Have you checked out MVExpand?
That might be what you are looking for: https://docs.microsoft.com/en-us/azure/kusto/query/mvexpandoperatorThat worked! Thank you!
AWSCloudTrail
| extend Policies = parse_json(RequestParameters).ipPermissions.items| mvexpand Policies
