Forum Discussion
query InsightMetrics with where clause on Tags
Hi I want to run a query to match an entry on tags which is a json like -
| TenantId | SourceSystem | TimeGenerated | Computer | Origin | Namespace | Name | Val | Tags | AgentId | Type | _ResourceId |
Values of Tags Column ->
{"address":"x.x.x.x","app.kubernetes.io/component":"compact","app.kubernetes.io/instance":"app","app.kubernetes.io/managed-by":"app2","app.kubernetes.io/name":"mayank"}
I want something like
-----------------------------
InsightsMetrics
| extend Tags = parse_json(Tags)
| where Namespace == "prometheus"
| where Tags.app.kubernetes.io/name == mayank
But I am not able to do so and getting empty records.
2 Replies
The "/" is the issue as its a control character in KQL. This would be an example that works, you can alter
InsightsMetrics | extend Tags = parse_json(Tags) //| where Namespace == "prometheus" | extend memorySizeMB_ = tostring(Tags.["vm.azm.ms/memorySizeMB"]) | where memorySizeMB_ == "mayank"Go to Log Analytics and run query
or better still
InsightsMetrics | extend Tags = parse_json(Tags) //| where Namespace == "prometheus" | where Tags.["vm.azm.ms/memorySizeMB"] > 5- Thanks Clive that worked for me 🙂
