How to get parse_json result property ignore case in Azure Application Insight log query?

The log item looks like below, the currencyamount field has multiple case situation:

{ "AdditionalFields":{ 
  "backendRequestBody":{
      "currencyamount":1
} } }

{ "AdditionalFields":{ 
  "backendRequestBody":{
      "CurrencyAmount":1
} } }

{ "AdditionalFields":{ 
  "backendRequestBody":{
      "currencyAmount":1
} } }

However, the parse_json log query is case sensitive, using azure log query?

The query below only able to get one of the log entry which has lower case currencyamount field.

AzureDiagnostics 
| where apiId_s contains "targetId" and AdditionalFields.backendRequestBody has "amount"
| extend amt = (parse_json(tostring(AdditionalFields.backendRequestBody)).currencyamount)

How to get parse_json result property ignore case in Azure Application Insight log query?

Good Question 0Comment Collection Report

0 Answer

dxhdenver 注册会员
2023-01-25 05:48

AFAIK, in we cannot be able to use . Instead of that you can use following way to achieve.

AzureActivity
| where apiId_s contains "targetId" and AdditionalFields.backendRequestBody has "amount"
| extend backendReqbody = parse_json(AdditionalFields.backendRequestBody)
| extend lowercuramount = parse_json(tostring(parse_json(backendReqbody.currencyamount)))
| extend curamount = parse_json(tostring(parse_json(backendReqbody.CurrencyAmount)))
| extend lowupcuramount = parse_json(tostring(parse_json(backendReqbody.currencyAmount)))

You can use conditions like (iff) Ms -Doc while filtering the data in a result.