Dynamic parsing of logs in Azure using KQL

%3CLINGO-SUB%20id%3D%22lingo-sub-2585600%22%20slang%3D%22en-US%22%3EDynamic%20parsing%20of%20logs%20in%20Azure%20using%20KQL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2585600%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20couple%20of%20Custom%20Logs%20in%20Log-Analytics.%20I%20want%20to%20parse%20columns%20of%20one%20log%20using%20columns%20from%20another%20log.%20Using%20join%20I%20can%20get%20to%20the%20stage%20where%20all%20the%20data%20is%20in%20a%20single%20table.%3CBR%20%2F%3ELike%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3ELabel%3C%2FTD%3E%3CTD%3EData%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EFirst%3C%2FTD%3E%3CTD%3EFirst%3Dabc%20%2C%20Second%3Ddef%20%2C%20Third%3D%20ghi%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3ESecond%3C%2FTD%3E%3CTD%3EFirst%3Dabc%20%2C%20Second%3Ddef%20%2C%20Third%3D%20ghi%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20want%20another%20column%20with%20the%20respective%20data%20mapped%20like%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3ELabel%3C%2FTD%3E%3CTD%3EData%3C%2FTD%3E%3CTD%3EValue%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EFirst%3C%2FTD%3E%3CTD%3EFirst%3Dabc%20%2C%20Second%3Ddef%20%2C%20Third%3D%20ghi%3C%2FTD%3E%3CTD%3Eabc%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3ESecond%3C%2FTD%3E%3CTD%3EFirst%3Dabc%20%2C%20Second%3Ddef%20%2C%20Third%3D%20ghi%3C%2FTD%3E%3CTD%3Edef%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20I%20can%20parse%20this.%20I%20have%20tried%20using%20the%20KQL's%20parse%20function%20and%20regex.%20But%20they%20only%20work%20to%20parse%20fixed%20statements.%20Here%20the%20**Label**%20is%20not%20fixed.%3C%2FP%3E%3CP%3EAny%20tips%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2585600%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ELog%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
New Contributor

I have a couple of Custom Logs in Log-Analytics. I want to parse columns of one log using columns from another log. Using join I can get to the stage where all the data is in a single table.
Like:

 

LabelData
FirstFirst=abc , Second=def , Third= ghi
SecondFirst=abc , Second=def , Third= ghi

 

I want another column with the respective data mapped like:

 

LabelDataValue
FirstFirst=abc , Second=def , Third= ghiabc
SecondFirst=abc , Second=def , Third= ghidef

 

Is there a way I can parse this. I have tried using the KQL's parse function and regex. But they only work to parse fixed statements. Here the **Label** is not fixed.

Any tips?

0 Replies