parse 運算符

發行項
05/19/2024

評估字串表示式，並將其值剖析成一或多個匯出數據行。計算結果列會有 Null，但未成功剖析的字串。如果不需要使用剖析失敗的數據列，偏好使用 parse-where 運算符。

語法

T| parse [ kind [ flags=kind=regexFlags ]] expressionwith [ * ] stringConstantcolumnName [:columnType] [ * ] , ...

深入瞭解語法慣例。

參數

姓名	類型	必要	描述
T	`string`	✔️	要剖析的表格式輸入。
種類	`string`	✔️	其中一個支援的種類值。預設值是 `simple`。
regexFlags	`string`		如果 kind 為 `regex`，則您可以指定 regex 旗標，例如 `U` 用於不油、 `m` 多行模式、 `s` 比對新行 `\n`，以及 `i` 不區分大小寫。您可以在 Flags 中找到更多旗標。
expression	`string`	✔️	評估為字串的表達式。
stringConstant	`string`	✔️	要搜尋和剖析的字串常數。
columnName	`string`	✔️	要指派值的數據行名稱，從字串表達式擷取。
columnType	`string`		指示要將值轉換成何種型別的純量值。預設值為 `string`。

注意

剖析模式可能以 ColumnName 開頭，而不只是使用 StringConstant。
在 * 模式中使用來略過垃圾郵件值。 *無法在類型資料string列之後使用。
如果剖析的運算式不是型string別，則會轉換成類型 string 。
如果您要卸除或重新命名某些資料列，請使用 project 。

支援的種類值

Text	描述
`simple`	這是預設值。 stringConstant 是一般字串值，而且比對是 strict。所有字串分隔符號都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`regex`	stringConstant 可能是正則表達式，而且比對是 strict。所有字串分隔符號 (可以是此模式的規則運算式) 都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`relaxed`	stringConstant 是一般字串值，而且比對是寬鬆的。所有字串分隔符號都應出現在剖析字串中，但是擴展資料行則可以與要求的型別部分相符。不符合所需類型的擴充數據行將取得值 `null`。

Regex 模式

在 regex 模式中，剖析會將模式轉譯為 regex。使用正則表達式來執行比對，並使用內部處理的編號擷取群組。例如：

parse kind=regex Col with * <regex1> var1:string <regex2> var2:long

在 parse 語句中，剖析將在內部產生的 regex 是 .*?<regex1>(.*?)<regex2>(\-\d+)。

* 已轉譯為 .*?。
string 已轉譯為 .*?。
long 已轉譯為 \-\d+。

傳回

輸入數據表，會根據提供給運算子的數據行清單來擴充。

範例

運算子parse會使用相同string運算式上的多個extract應用程式，為數據表提供簡化的方式extend。當數據表有包含數個 string 您想要分成個別數據行的值時，這個結果很有用。例如，開發人員追蹤（“/printf”“Console.WriteLine）語句所產生的數據行。

在下列範例中，假設數據表Traces的數據行EventText包含表單Event: NotifySliceRelease (resourceName={0}, totalSlices={1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5})的字串。此工作會將資料表擴充為六個資料列：resourceName、、totalSlices、sliceNumberlockTime、、 releaseTime和 previousLockTime。

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long * "sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *  
| project resourceName, totalSlices, sliceNumber, lockTime, releaseTime, previousLockTime

輸出

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	20	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

Regex 模式

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse kind = regex EventText with "(.*?)[a-zA-Z]*=" resourceName @", totalSlices=\s*\d+\s*.*?sliceNumber=" sliceNumber: long  ".*?(previous)?lockTime=" lockTime ".*?releaseTime=" releaseTime ".*?previousLockTime=" previousLockTime: date "\\)"  
| project resourceName, sliceNumber, lockTime, releaseTime, previousLockTime

輸出

resourceName	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	15	02/17/2016 08:40:00,	02/17/2016 08:40:00,	2016-02-17 08:39:00.0000000
PipelineScheduler	23	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	20	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	16	02/17/2016 08:41:00,	02/17/2016 08:41:00,	2016-02-17 08:40:00.0000000
PipelineScheduler	22	02/17/2016 08:41:01,	02/17/2016 08:41:00,	2016-02-17 08:40:01.0000000

具有 regex 旗標的 Regex 模式

如果您只想要取得 resourceName，請使用此查詢：

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind = regex EventText with * "resourceName=" resourceName ',' *
| project resourceName

輸出

resourceName
PipelineScheduler， totalSlices=27， sliceNumber=23， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=15， lockTime=02/17/2016 08：40：00， releaseTime=02/17/2016 08：40：00
PipelineScheduler， totalSlices=27， sliceNumber=20， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=22， lockTime=02/17/2016 08：41：01， releaseTime=02/17/2016 08：41：00
PipelineScheduler， totalSlices=27， sliceNumber=16， lockTime=02/17/2016 08：41：00， releaseTime=02/17/2016 08：41：00

因為預設模式很貪婪，因此您不會取得預期的結果。如果您有一些記錄， resourceName 其中有時顯示為小寫，有時顯示為大寫，您可能會取得某些值的 Null。

若要取得想要的結果，請使用非窮盡 U執行查詢，並停用區分大小寫 i 的 regex 旗標。

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind = regex flags = Ui EventText with * "RESOURCENAME=" resourceName ',' *
| project resourceName

輸出

resourceName
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler

如果剖析的字串有換行符，請使用旗標 s來剖析文字。

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=23\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=15\nlockTime=02/17/2016 08:40:00\nreleaseTime=02/17/2016 08:40:00\npreviousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=20\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=22\nlockTime=02/17/2016 08:41:01\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=16\nlockTime=02/17/2016 08:41:00\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=s EventText with * "resourceName=" resourceName: string "(.*?)totalSlices=" totalSlices: long "(.*?)lockTime=" lockTime: datetime "(.*?)releaseTime=" releaseTime: datetime "(.*?)previousLockTime=" previousLockTime: datetime "\\)" 
| project-away EventText

輸出

resourceName	totalSlices	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	2016-02-17 08:40:00.0000000	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:41:00.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	2016-02-17 08:41:01.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

寬鬆模式

在這裡範例中，對於寬鬆模式， totalSlices 擴充數據行的類型必須為 long。不過，在剖析的字串中，它具有值 nonValidLongValue。在 releaseTime 擴充資料列中 nonValidDateTime ，值無法剖析為 datetime。這兩個擴充數據行會取得值 null ，而其他數據行，例如 sliceNumber，仍會取得正確的值。

如果您針對下面的相同查詢使用選項 kind = simple ，則會 null 取得所有擴充數據行的選項。此選項在擴充數據行上是嚴格的，而且是寬鬆和簡單模式之間的差異。

注意

在寬鬆模式中，擴充數據行可以部分比對。

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=nonValidDateTime, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=relaxed EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *
| project-away EventText

輸出

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00		2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		20	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

Share via

parse 運算符

語法

參數

支援的種類值

Regex 模式

傳回

範例

Regex 模式

具有 regex 旗標的 Regex 模式

寬鬆模式

意見反應

意見反應

其他資源

Share via

parse 運算符

語法

參數

支援的種類值

Regex 模式

傳回

範例

Regex 模式

具有 regex 旗標的 Regex 模式

寬鬆模式

相關內容

意見反應

意見反應

其他資源