todynamic(), parse_json()
Interprets a string as a JSON value and returns the value as dynamic. If possible, the value is converted into relevant data types. For strict parsing with no data type conversion, use extract() or extractjson() functions.
Note
The todynamic() and parse_json() functions are interpreted equivalently.
This function is better than extractjson() function when you need to extract more than one element of a JSON compound object. Prefer using dynamic() when possible.
Syntax
parse_json(json)
todynamic(json)
Arguments
- json: An expression of type
string. It represents a JSON-formatted value, or an expression of type dynamic, representing the actualdynamicvalue.
Returns
An object of type dynamic that is determined by the value of json:
- If json is of type
dynamic, its value is used as-is. - If json is of type
string, and is a properly formatted JSON string, then the string is parsed, and the value produced is returned. - If json is of type
string, but it isn't a properly formatted JSON string, then the returned value is an object of typedynamicthat holds the originalstringvalue.
Example
In the following example, when context_custom_metrics is a string
that looks like this:
{"duration":{"value":118.0,"count":5.0,"min":100.0,"max":150.0,"stdDev":0.0,"sampledValue":118.0,"sum":118.0}}
then the following CSL Fragment retrieves the value of the duration slot
in the object, and from that it retrieves two slots, duration.value and
duration.min (118.0 and 110.0, respectively).
T
| extend d=parse_json(context_custom_metrics)
| extend duration_value=d.duration.value, duration_min=d["duration"]["min"]
Notes
It's common to have a JSON string describing a property bag in which one of the "slots" is another JSON string.
For example:
let d='{"a":123, "b":"{\\"c\\":456}"}';
print d
In such cases, it isn't only necessary to invoke parse_json twice, but also
to make sure that in the second call, tostring is used. Otherwise, the
second call to parse_json will just pass on the input to the output as-is,
because its declared type is dynamic.
let d='{"a":123, "b":"{\\"c\\":456}"}';
print d_b_c=parse_json(tostring(parse_json(d).b)).c