todynamic(), parse_json()

Interprets a string as a JSON value and returns the value as dynamic. If possible, the value is converted into relevant data types. For strict parsing with no data type conversion, use extract() or extractjson() functions.

Note

The todynamic() and parse_json() functions are interpreted equivalently.

This function is better than extractjson() function when you need to extract more than one element of a JSON compound object. Prefer using dynamic() when possible.

Syntax

parse_json(json) todynamic(json)

Arguments

  • json: An expression of type string. It represents a JSON-formatted value, or an expression of type dynamic, representing the actual dynamic value.

Returns

An object of type dynamic that is determined by the value of json:

  • If json is of type dynamic, its value is used as-is.
  • If json is of type string, and is a properly formatted JSON string, then the string is parsed, and the value produced is returned.
  • If json is of type string, but it isn't a properly formatted JSON string, then the returned value is an object of type dynamic that holds the original string value.

Example

In the following example, when context_custom_metrics is a string that looks like this:

{"duration":{"value":118.0,"count":5.0,"min":100.0,"max":150.0,"stdDev":0.0,"sampledValue":118.0,"sum":118.0}}

then the following CSL Fragment retrieves the value of the duration slot in the object, and from that it retrieves two slots, duration.value and duration.min (118.0 and 110.0, respectively).

T
| extend d=parse_json(context_custom_metrics) 
| extend duration_value=d.duration.value, duration_min=d["duration"]["min"]

Notes

It's common to have a JSON string describing a property bag in which one of the "slots" is another JSON string.

For example:

let d='{"a":123, "b":"{\\"c\\":456}"}';
print d

In such cases, it isn't only necessary to invoke parse_json twice, but also to make sure that in the second call, tostring is used. Otherwise, the second call to parse_json will just pass on the input to the output as-is, because its declared type is dynamic.

let d='{"a":123, "b":"{\\"c\\":456}"}';
print d_b_c=parse_json(tostring(parse_json(d).b)).c