Table Transformation DCR

Question

I would like to transform my table using the transformation editor. I have the following KQL used for the transformation:

source | extend regexPattern = "}{"messageType""

| extend modifiedString = replace_string(Message, regexPattern, "},{"messageType"")

| extend messageParsed = strcat("[", modifiedString, "]")

| project TimeGenerated,messageParsed, Type

This KQL works properly when running it in Azure Log Analytics. However, when running it in the transformation editor, I encounter an error related to the 'replace_string' function:

"Error occurred while compiling query in query: SemanticError:0x00000009 at 3:26 : Runtime scalar function provider not found for function: replace_string"

How can I resolve this?

Answer 1

This documentation details the structure of Kusto Query Language (KQL) transformations within Azure Monitor Data Collection Rules (DCRs) and explicitly mentions the limitations of supported KQL functions.

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-transformations-structure

as you can see not all the KQL functions are supported for DCRs

While they might not be as direct as replace_string or replace_regex, you may be able to achieve similar results with functions like substring, parse, split, etc.

maybe something like that

source
| extend messageParsed = strcat("[", substring(Message, 0, indexof(Message, "}{") + 1), "},{", substring(Message, indexof(Message, "}{") + 2), "]") 
| project TimeGenerated, messageParsed, Type

Answer 2

I was trying to use replace_regex function with the following signature replace_regex(source, lookup_regex, rewrite_pattern) (https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/replace-regex-function), but I was having the same error. But, there is a replace function with the signature replace(regex, rewrite, text) (https://github.com/microsoft/Kusto-Query-Language/blob/master/doc/replacefunction.md), which works perfectly for me.