Operatore parse-whereparse-where operator

Valuta un'espressione stringa e ne analizza il valore in una o più colonne calcolate.Evaluates a string expression, and parses its value into one or more calculated columns. Il risultato è solo le stringhe analizzate correttamente.The result is only the successfully parsed strings.

Vedere operatore parse, che produce valori null per le stringhe analizzate in modo non corretto.See parse operator, which produces nulls for unsuccessfully parsed strings.

T | parse-where Text with "ActivityName=" name ", ActivityType=" type

SintassiSyntax

T | parse-where [ kind=regex [ flags=regex_flags ] | simple ] espressione with * (StringConstant ColumnName [ : ColumnType]) * ...T | parse-where [kind=regex [flags=regex_flags] |simple] Expression with * (StringConstant ColumnName [: ColumnType]) *...

ArgomentiArguments

  • T: tabella di input.T: The input table.

  • tipo:kind:

    • Simple (impostazione predefinita): StringConstant è un normale valore stringa e la corrispondenza è Strict.simple (default): StringConstant is a regular string value, and the match is strict. Tutti i delimitatori di stringa devono essere visualizzati nella stringa analizzata e tutte le colonne estese devono corrispondere ai tipi richiesti.All string delimiters should appear in the parsed string, and all extended columns must match the required types.

    • Regex: StringConstant può essere un'espressione regolare e la corrispondenza è rigida.regex: StringConstant may be a regular expression, and the match is strict. Tutti i delimitatori di stringa devono essere visualizzati nella stringa analizzata e tutte le colonne estese devono corrispondere ai tipi richiesti.All string delimiters should appear in the parsed string, and all extended columns must match the required types. I delimitatori di stringa possono essere Regex per questa modalità.String delimiters can be a regex for this mode.

    • Flags: Flag da utilizzare in modalità Regex: U (ungreedy), m (modalità a più righe), s (corrispondenza nuova riga \n ), (senza i distinzione tra maiuscole e minuscole), è possibile trovare più flag nei flag RE2.flags: Flags to be used in regex mode: U (Ungreedy), m (multi-line mode), s (match new line \n), i (case-insensitive), More flags can be found in RE2 flags.

  • Expression: espressione che restituisce una stringa.Expression: An expression that evaluates to a string.

  • ColumnName: Nome di una colonna assegnata a un valore che è stato eliminato dall'espressione stringa.ColumnName: The name of a column that is assigned to a value that was taken out of the string expression.

  • ColumnType: deve essere un tipo scalare facoltativo che indica il tipo in cui convertire il valore.ColumnType: should be an optional scalar type that indicates the type to convert the value to. Il valore predefinito è tipo stringa.The default is string type.

RestituisceReturns

Tabella di input, che viene estesa in base all'elenco di colonne fornite all'operatore.The input table, which is extended according to the list of columns that are provided to the operator.

Nota

Solo le stringhe analizzate correttamente saranno nell'output.Only successfully parsed strings will be in the output. Le stringhe che non corrispondono al modello verranno escluse.Strings that don't match the pattern will be filtered out.

SuggerimentiTips

  • parse-whereanalizza le stringhe in modo analogo all' analisie filtra le stringhe che non sono state analizzate correttamente.parse-where parses the strings in the same way as parse, and filters out strings that were not parsed successfully.

  • Usare Project se si vuole anche eliminare o rinominare alcune colonne.Use project if you also want to drop or rename some columns.

  • Usare * nel modello per ignorare i valori indesiderati.Use * in the pattern to skip junk values. Non è possibile utilizzare questo valore dopo la colonna stringa.This value can't be used after string column.

  • Il modello di analisi può iniziare con ColumnName, oltre a StringConstant.The parse pattern may start with ColumnName, in addition to StringConstant.

  • Se l' espressione analizzata non è di tipo stringa, verrà convertita nel tipo stringa.If the parsed Expression isn't of type string, it will be converted to type string.

  • Se si usa la modalità Regex, è possibile aggiungere flag Regex per controllare l'intera espressione regolare usata nell'analisi.If regex mode is used, you can add regex flags to control the whole regex used in parse.

  • In modalità Regex l'analisi converte il modello in un'espressione regolare e usa la sintassi RE2 per eseguire la corrispondenza con i gruppi acquisiti numerati che vengono gestiti internamente.In regex mode, parse will translate the pattern to a regex and use RE2 syntax in order to do the matching using numbered captured groups that are handled internally.

    Ad esempio, questa istruzione parse:For example, this parse statement:

    parse-where kind=regex Col with * <regex1> var1:string <regex2> var2:long
    

    Espressione regolare che verrà generata dall'analisi internamente .*?<regex1>(.*?)<regex2>(\-\d+) .The regex that will be generated by the parse internally is .*?<regex1>(.*?)<regex2>(\-\d+).

    • *è stato convertito in .*? .* was translated to .*?.

    • stringè stato convertito in .*? .string was translated to .*?.

    • longè stato convertito in \-\d+ .long was translated to \-\d+.

EsempioExamples

L' parse-where operatore fornisce una modalità semplificata a extend una tabella utilizzando più extract applicazioni nella stessa string espressione.The parse-where operator provides a streamlined way to extend a table by using multiple extract applications on the same string expression. Questa operazione è particolarmente utile quando la tabella include una string colonna che contiene diversi valori che si desidera suddividere in singole colonne.This is most useful when the table has a string column that contains several values that you want to break into individual columns. È ad esempio possibile suddividere una colonna prodotta da un'istruzione di traccia per sviluppatori (" printf "/" Console.WriteLine ").For example, you can break up a column that was produced by a developer trace ("printf"/"Console.WriteLine") statement.

Uso di parseUsing parse

Nell'esempio seguente la colonna EventText della tabella Traces contiene stringhe nel formato Event: NotifySliceRelease (resourceName={0}, totalSlices= {1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5}) .In the example below, the column EventText of table Traces contains strings of the form Event: NotifySliceRelease (resourceName={0}, totalSlices= {1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5}). L'operazione seguente estenderà la tabella con sei colonne: resourceName ,, totalSlices sliceNumber , lockTime , releaseTime , previouLockTime , Month e Day .The operation below will extend the table with six columns: resourceName , totalSlices, sliceNumber, lockTime , releaseTime, previouLockTime, Month, and Day.

Alcune stringhe non hanno una corrispondenza completa.A few of the strings don't have a full match.

Se parse si utilizza, le colonne calcolate disporranno di valori null.Using parse, the calculated columns will have nulls.

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=invalid_number, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=invalid_datetime, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=invalid_number, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices:long * "sliceNumber=" sliceNumber:long * "lockTime=" lockTime ", releaseTime=" releaseTime:date "," * "previousLockTime=" previouLockTime:date ")" *  
| project resourceName ,totalSlices , sliceNumber , lockTime , releaseTime , previousLockTime
resourceNameresourceName totalSlicestotalSlices sliceNumbersliceNumber lockTimelockTime releaseTimereleaseTime previousLockTimepreviousLockTime
PipelineSchedulerPipelineScheduler 2727 2020 02/17/2016 08:40:0102/17/2016 08:40:01 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 2727 2222 02/17/2016 08:41:0102/17/2016 08:41:01 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000

Uso di parse-whereUsing parse-where

Con ' Parse-Where ' si filtrano le stringhe analizzate in modo non corretto dal risultato.Using 'parse-where' will filter-out unsuccessfully parsed strings from the result.

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=invalid_number, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=invalid_datetime, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=invalid_number, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse-where EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices:long * "sliceNumber=" sliceNumber:long * "lockTime=" lockTime ", releaseTime=" releaseTime:date "," * "previousLockTime=" previousLockTime:date ")" *  
| project resourceName ,totalSlices , sliceNumber , lockTime , releaseTime , previousLockTime
resourceNameresourceName totalSlicestotalSlices sliceNumbersliceNumber lockTimelockTime releaseTimereleaseTime previousLockTimepreviousLockTime
PipelineSchedulerPipelineScheduler 2727 2020 02/17/2016 08:40:0102/17/2016 08:40:01 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000 2016-02-17 08:39:01.00000002016-02-17 08:39:01.0000000
PipelineSchedulerPipelineScheduler 2727 2222 02/17/2016 08:41:0102/17/2016 08:41:01 2016-02-17 08:41:00.00000002016-02-17 08:41:00.0000000 2016-02-17 08:40:01.00000002016-02-17 08:40:01.0000000

Modalità Regex con flag RegexRegex mode using regex flags

Per ottenere resourceName e totalSlices, usare la query seguente:To get the resourceName and totalSlices, use the following query:

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=non_valid_integer, sliceNumber=11, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=non_valid_integer, sliceNumber=44, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse-where kind = regex EventText with * "RESOURCENAME=" resourceName "," * "totalSlices=" totalSlices:long "," *
| project resourceName, totalSlices

parse-wherecon flag Regex senza distinzione tra maiuscole e minuscoleparse-where with case-insensitive regex flag

Nella query precedente, la modalità predefinita distingue tra maiuscole e minuscole, pertanto le stringhe sono state analizzate correttamente.In the above query, the default mode was case-sensitive, so the strings were parsed successfully. Non è stato ottenuto alcun risultato.No result was obtained.

Per ottenere il risultato necessario, eseguire parse-where con un flag Regex senza distinzione tra maiuscole e minuscole ( i ).To get the required result, run parse-where with a case-insensitive (i) regex flag.

Solo tre stringhe verranno analizzate correttamente, quindi il risultato è tre record (alcuni totalSlices contengono numeri interi non validi).Only three strings will be parsed successfully, so the result is three records (some totalSlices hold invalid integers).

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=non_valid_integer, sliceNumber=11, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=non_valid_integer, sliceNumber=44, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse-where kind = regex flags=i EventText with * "RESOURCENAME=" resourceName "," * "totalSlices=" totalSlices:long "," *
| project resourceName, totalSlices
resourceNameresourceName totalSlicestotalSlices
PipelineSchedulerPipelineScheduler 2727
PipelineSchedulerPipelineScheduler 2727
PipelineSchedulerPipelineScheduler 2727