query InsightMetrics with where clause on Tags

%3CLINGO-SUB%20id%3D%22lingo-sub-1288185%22%20slang%3D%22en-US%22%3Equery%20InsightMetrics%20with%20where%20clause%20on%20Tags%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1288185%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20I%20want%20to%20run%20a%20query%20to%20match%20an%20entry%20on%20tags%20which%20is%20a%20json%20like%20-%3C%2FP%3E%3CTABLE%20width%3D%22832%22%3E%3CTBODY%3E%3CTR%3E%3CTD%20width%3D%2264%22%3ETenantId%3C%2FTD%3E%3CTD%20width%3D%2264%22%3ESourceSystem%3C%2FTD%3E%3CTD%20width%3D%2264%22%3ETimeGenerated%3C%2FTD%3E%3CTD%20width%3D%2264%22%3EComputer%3C%2FTD%3E%3CTD%20width%3D%2264%22%3EOrigin%3C%2FTD%3E%3CTD%20width%3D%2264%22%3ENamespace%3C%2FTD%3E%3CTD%20width%3D%2264%22%3EName%3C%2FTD%3E%3CTD%20width%3D%2264%22%3EVal%3C%2FTD%3E%3CTD%20width%3D%2264%22%3ETags%3C%2FTD%3E%3CTD%20width%3D%2264%22%3EAgentId%3C%2FTD%3E%3CTD%20width%3D%2264%22%3EType%3C%2FTD%3E%3CTD%20width%3D%22128%22%3E_ResourceId%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3EValues%20of%20Tags%20Column%20-%26gt%3B%3C%2FP%3E%3CP%3E%7B%22address%22%3A%22x.x.x.x%22%2C%22app.kubernetes.io%2Fcomponent%22%3A%22compact%22%2C%22app.kubernetes.io%2Finstance%22%3A%22app%22%2C%22app.kubernetes.io%2Fmanaged-by%22%3A%22app2%22%2C%22app.kubernetes.io%2Fname%22%3A%22mayank%22%7D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20want%20something%20like%3C%2FP%3E%3CP%3E-----------------------------%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EInsightsMetrics%20%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eextend%3C%2FSPAN%3E%3CSPAN%3E%20Tags%20%3D%20parse_json(Tags)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Namespace%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22prometheus%22%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%7C%20where%20Tags.app.kubernetes.io%2Fname%20%3D%3D%20mayank%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20I%20am%20not%20able%20to%20do%20so%20and%20getting%20empty%20records.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1288185%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%20Insights%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
New Contributor

Hi I want to run a query to match an entry on tags which is a json like -

TenantIdSourceSystemTimeGeneratedComputerOriginNamespaceNameValTagsAgentIdType_ResourceId

Values of Tags Column ->

{"address":"x.x.x.x","app.kubernetes.io/component":"compact","app.kubernetes.io/instance":"app","app.kubernetes.io/managed-by":"app2","app.kubernetes.io/name":"mayank"}

 

I want something like

-----------------------------

InsightsMetrics
| extend Tags = parse_json(Tags)
| where Namespace == "prometheus"

| where Tags.app.kubernetes.io/name == mayank

 

But I am not able to do so and getting empty records.

2 Replies
Highlighted

@mayanks

 

The "/" is the issue as its a control character in KQL.   This would be an example that works, you can alter

InsightsMetrics
| extend Tags = parse_json(Tags)
//| where Namespace == "prometheus"
| extend memorySizeMB_ = tostring(Tags.["vm.azm.ms/memorySizeMB"]) 
| where memorySizeMB_ == "mayank"

 

 Go to Log Analytics and run query

 

or better still

 

InsightsMetrics
| extend Tags = parse_json(Tags)
//| where Namespace == "prometheus"
| where Tags.["vm.azm.ms/memorySizeMB"]  > 5

 

Highlighted
Thanks Clive that worked for me :)