parse 運算子

評估字串運算式,並將其值剖析至一或多個計算的資料行。 計算結果欄會有 Null,代表未成功剖析的字串。 如果不需要使用未成功剖析的資料列,請使用 parse where 運算子

T | parse Text with "ActivityName=" name ", ActivityType=" type

語法

T | parse [kind=regex [flags=regex_flags] |simple|relaxed] Expression with * (StringConstant ColumnName [: ColumnType]) *...

引數

  • T:輸入資料表。

  • 種類:

    • 簡單 (預設值):StringConstant 是一般字串值,相符條件嚴格。 所有字串分隔符號都應該出現在剖析的字串中,而且所有擴充的資料行都必須符合所需的類型。

    • regex:StringConstant 可以是規則運算式,相符條件嚴格。 所有字串分隔符號 (可能是此模式的 RegEx) 都應該出現在剖析的字串中,而且所有擴充的資料行都必須符合所需的類型。

    • flags:用於 RegEx 模式的旗標,例如 RE2 旗標中的 U (非窮盡 (Ungreedy))、m (多行模式)、s (符合新行 \n)、i (不區分大小寫)。

    • 寬鬆:StringConstant 是一般字串值,相符條件寬鬆。 所有字串分隔符號都應該出現在剖析的字串中,但擴充的資料行可以部份符合所需的類型。 不符合所需類型的擴充資料行將會取得 Null 值。

  • 運算式:評估為字串的運算式。

  • ColumnName: 要對其指派值的資料行名稱,從字串運算式中擷取。

  • ColumnType: 選擇性。 純量值,表示要將值轉換成該類型。 預設值為 string 類型。

傳回

輸入資料表,根據提供給運算子的資料行清單進行擴充。

提示

  • 如果您也想要捨棄或重新命名某些資料行,請使用 project

  • 在模式中使用 * 來略過垃圾值。

    注意

    * 不能用在 string 類型資料行之後。

  • 剖析模式的開頭可能是 ColumnName,而不只是 StringConstant。

  • 如果剖析的「運算式」不是 string 類型,其會轉換成 string 類型。

  • 如果使用 RegEx 模式,您可以選擇新增 RegEx 旗標來控制剖析中使用的整個 RegEx。

  • 在 RegEx 模式中,parse 會將模式 (pattern) 轉譯成 RegEx。 使用 RE2 語法來執行比對,並使用在內部進行處理且已編號的擷取群組。 例如:

    parse kind=regex Col with * <regex1> var1:string <regex2> var2:long
    

    在 parse 陳述式中,parse 在內部產生的 RegEx 是 .*?<regex1>(.*?)<regex2>(\-\d+)

    • * 已翻譯成 .*?

    • string 已翻譯成 .*?

    • long 已翻譯成 \-\d+

範例

parse 運算子可讓您在相同的 string 運算式上使用多個 extract 應用程式,以簡化 extend 資料表的方式。 當資料表的 string 資料行包含多個您想要細分為個別資料行的值時,這個結果就很有用。 例如,developer trace ("printf"/"Console.WriteLine") 陳述式產生的資料行。

在下列範例中,假設 Traces 資料表的 EventText 資料行包含 Event: NotifySliceRelease (resourceName={0}, totalSlices={1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5}) 形式的字串。 作業將會以六個資料行來擴充資料表:resourceNametotalSlicessliceNumberlockTime releaseTimepreviousLockTime

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices:long * "sliceNumber=" sliceNumber:long * "lockTime=" lockTime ", releaseTime=" releaseTime:date "," * "previousLockTime=" previousLockTime:date ")" *  
| project resourceName, totalSlices, sliceNumber, lockTime, releaseTime, previousLockTime
resourceName totalSlices sliceNumber lockTime releaseTime previousLockTime
PipelineScheduler 27 15 02/17/2016 08:40:00 2016-02-17 08:40:00.0000000 2016-02-17 08:39:00.0000000
PipelineScheduler 27 23 02/17/2016 08:40:01 2016-02-17 08:40:01.0000000 2016-02-17 08:39:01.0000000
PipelineScheduler 27 20 02/17/2016 08:40:01 2016-02-17 08:40:01.0000000 2016-02-17 08:39:01.0000000
PipelineScheduler 27 16 02/17/2016 08:41:00 2016-02-17 08:41:00.0000000 2016-02-17 08:40:00.0000000
PipelineScheduler 27 22 02/17/2016 08:41:01 2016-02-17 08:41:00.0000000 2016-02-17 08:40:01.0000000

適用於 RegEx 模式

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse kind = regex EventText with "(.*?)[a-zA-Z]*=" resourceName @", totalSlices=\s*\d+\s*.*?sliceNumber=" sliceNumber:long  ".*?(previous)?lockTime=" lockTime ".*?releaseTime=" releaseTime ".*?previousLockTime=" previousLockTime:date "\\)"  
| project resourceName, sliceNumber, lockTime, releaseTime, previousLockTime
resourceName sliceNumber lockTime releaseTime previousLockTime
PipelineScheduler 15 02/17/2016 08:40:00, 02/17/2016 08:40:00, 2016-02-17 08:39:00.0000000
PipelineScheduler 23 02/17/2016 08:40:01, 02/17/2016 08:40:01, 2016-02-17 08:39:01.0000000
PipelineScheduler 20 02/17/2016 08:40:01, 02/17/2016 08:40:01, 2016-02-17 08:39:01.0000000
PipelineScheduler 16 02/17/2016 08:41:00, 02/17/2016 08:41:00, 2016-02-17 08:40:00.0000000
PipelineScheduler 22 02/17/2016 08:41:01, 02/17/2016 08:41:00, 2016-02-17 08:40:01.0000000

適用於使用 RegEx 旗標的 RegEx 模式

如果您只想要取得 resourceName,請使用下列查詢:

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind = regex  EventText with * "resourceName=" resourceName ',' *
| project resourceName
resourceName
PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01
PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00
PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01
PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00
PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00

您不會得到預期的結果,因為預設模式是 [窮盡]。 如果您有一些記錄,其中 resourceName 有時候會顯示為小寫,而有時候是大寫,則您得到的某些值可能會是 Null。

若要取得想要的結果,請使用非窮盡的 U 來執行查詢,並停用區分大小寫的 i RegEx 旗標。

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind = regex flags = Ui EventText with * "RESOURCENAME=" resourceName ',' *
| project resourceName
resourceName
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler

如果剖析過的字串具有分行符號,請使用旗標 s 來剖析文字。

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=23\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=15\nlockTime=02/17/2016 08:40:00\nreleaseTime=02/17/2016 08:40:00\npreviousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=20\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=22\nlockTime=02/17/2016 08:41:01\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=16\nlockTime=02/17/2016 08:41:00\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=s EventText with * "resourceName=" resourceName:string "(.*?)totalSlices=" totalSlices:long "(.*?)lockTime=" lockTime:datetime "(.*?)releaseTime=" releaseTime:datetime "(.*?)previousLockTime=" previousLockTime:datetime "\\)" 
| project-away EventText
resourceName totalSlices lockTime releaseTime previousLockTime
PipelineScheduler
27 2016-02-17 08:40:00.0000000 2016-02-17 08:40:00.0000000 2016-02-17 08:39:00.0000000
PipelineScheduler
27 2016-02-17 08:40:01.0000000 2016-02-17 08:40:01.0000000 2016-02-17 08:39:01.0000000
PipelineScheduler
27 2016-02-17 08:40:01.0000000 2016-02-17 08:40:01.0000000 2016-02-17 08:39:01.0000000
PipelineScheduler
27 2016-02-17 08:41:00.0000000 2016-02-17 08:41:00.0000000 2016-02-17 08:40:00.0000000
PipelineScheduler
27 2016-02-17 08:41:01.0000000 2016-02-17 08:41:00.0000000 2016-02-17 08:40:01.0000000

寬鬆模式

在此寬鬆模式的範例中,totalSlices 擴充資料行的類型必須是 long。 不過,在剖析的字串中,其值為 nonValidLongValue。 在 releaseTime 擴充資料行中,nonValidDateTime 值無法剖析為 datetime。 這兩個擴充的資料行會取得 Null 值,而其他資料行 (例如 sliceNumber) 仍然會取得正確的值。

如果您在下面的相同查詢中使用 kind = simple 選項,則所有擴充資料行都會得到 Null。 此選項在擴充資料行上是嚴格的,而且是寬鬆模式與簡單模式之間的差異。

注意

在寬鬆模式中,擴充的資料行可以部分相符。

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=nonValidDateTime, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=relaxed EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices:long * "sliceNumber=" sliceNumber:long * "lockTime=" lockTime ", releaseTime=" releaseTime:date "," * "previousLockTime=" previousLockTime:date ")" *
| project-away EventText
resourceName totalSlices sliceNumber lockTime releaseTime previousLockTime
PipelineScheduler 27 15 02/17/2016 08:40:00 2016-02-17 08:39:00.0000000
PipelineScheduler 27 23 02/17/2016 08:40:01 2016-02-17 08:39:01.0000000
PipelineScheduler 20 02/17/2016 08:40:01 2016-02-17 08:39:01.0000000
PipelineScheduler 16 02/17/2016 08:41:00 2016-02-17 08:41:00.0000000 2016-02-17 08:40:00.0000000
PipelineScheduler 27 22 02/17/2016 08:41:01 2016-02-17 08:41:00.0000000 2016-02-17 08:40:01.0000000