Apr 07 2020
05:24 AM
- last edited on
Apr 08 2022
10:22 AM
by
TechCommunityAP
Apr 07 2020
05:24 AM
- last edited on
Apr 08 2022
10:22 AM
by
TechCommunityAP
Hi I want to run a query to match an entry on tags which is a json like -
TenantId | SourceSystem | TimeGenerated | Computer | Origin | Namespace | Name | Val | Tags | AgentId | Type | _ResourceId |
Values of Tags Column ->
{"address":"x.x.x.x","app.kubernetes.io/component":"compact","app.kubernetes.io/instance":"app","app.kubernetes.io/managed-by":"app2","app.kubernetes.io/name":"mayank"}
I want something like
-----------------------------
| where Tags.app.kubernetes.io/name == mayank
But I am not able to do so and getting empty records.
Apr 07 2020 12:06 PM
The "/" is the issue as its a control character in KQL. This would be an example that works, you can alter
InsightsMetrics
| extend Tags = parse_json(Tags)
//| where Namespace == "prometheus"
| extend memorySizeMB_ = tostring(Tags.["vm.azm.ms/memorySizeMB"])
| where memorySizeMB_ == "mayank"
Go to Log Analytics and run query
or better still
InsightsMetrics
| extend Tags = parse_json(Tags)
//| where Namespace == "prometheus"
| where Tags.["vm.azm.ms/memorySizeMB"] > 5
Apr 08 2020 12:55 AM