bag_pack()
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Creates a dynamic property bag object from a list of keys and values.
Deprecated aliases: pack(), pack_dictionary()
Syntax
bag_pack(key1, value1, key2, value2,... )
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| key | string |
✔️ | The key name. |
| value | any scalar data type | ✔️ | The key value. |
Note
The key and value strings are an alternating list the total length of the list must be even.
Returns
Returns a dynamic property bag object from the listed key and value inputs.
Examples
Example 1
The following example creates and returns a property bag from an alternating list of keys and values.
print bag_pack("Level", "Information", "ProcessID", 1234, "Data", bag_pack("url", "www.bing.com"))
Results
| print_0 |
|---|
| {"Level":"Information","ProcessID":1234,"Data":{"url":"www.bing.com"}} |
Example 2
The following example creates a property bag and extract value from property bag using '.' operator.
datatable (
Source: int,
Destination: int,
Message: string
) [
1234, 100, "AA",
4567, 200, "BB",
1212, 300, "CC"
]
| extend MyBag=bag_pack("Dest", Destination, "Mesg", Message)
| project-away Source, Destination, Message
| extend MyBag_Dest=MyBag.Dest, MyBag_Mesg=MyBag.Mesg
Results
| MyBag | MyBag_Dest | MyBag_Mesg |
|---|---|---|
| {"Dest":100,"Mesg":"AA"} | 100 | AA |
| {"Dest":200,"Mesg":"BB"} | 200 | BB |
| {"Dest":300,"Mesg":"CC"} | 300 | CC |
Example 3
The following example uses two tables, SmsMessages and MmsMessages, and returns their common columns and a property bag from the other columns. The tables are created ad-hoc as part of the query.
SmsMessages
| SourceNumber | TargetNumber | CharsCount |
|---|---|---|
| 555-555-1234 | 555-555-1212 | 46 |
| 555-555-1234 | 555-555-1213 | 50 |
| 555-555-1212 | 555-555-1234 | 32 |
MmsMessages
| SourceNumber | TargetNumber | AttachmentSize | AttachmentType | AttachmentName |
|---|---|---|---|---|
| 555-555-1212 | 555-555-1213 | 200 | jpeg | Pic1 |
| 555-555-1234 | 555-555-1212 | 250 | jpeg | Pic2 |
| 555-555-1234 | 555-555-1213 | 300 | png | Pic3 |
let SmsMessages = datatable (
SourceNumber: string,
TargetNumber: string,
CharsCount: string
) [
"555-555-1234", "555-555-1212", "46",
"555-555-1234", "555-555-1213", "50",
"555-555-1212", "555-555-1234", "32"
];
let MmsMessages = datatable (
SourceNumber: string,
TargetNumber: string,
AttachmentSize: string,
AttachmentType: string,
AttachmentName: string
) [
"555-555-1212", "555-555-1213", "200", "jpeg", "Pic1",
"555-555-1234", "555-555-1212", "250", "jpeg", "Pic2",
"555-555-1234", "555-555-1213", "300", "png", "Pic3"
];
SmsMessages
| join kind=inner MmsMessages on SourceNumber
| extend Packed=bag_pack("CharsCount", CharsCount, "AttachmentSize", AttachmentSize, "AttachmentType", AttachmentType, "AttachmentName", AttachmentName)
| where SourceNumber == "555-555-1234"
| project SourceNumber, TargetNumber, Packed
Results
| SourceNumber | TargetNumber | Packed |
|---|---|---|
| 555-555-1234 | 555-555-1213 | {"CharsCount":"50","AttachmentSize":"250","AttachmentType":"jpeg","AttachmentName":"Pic2"} |
| 555-555-1234 | 555-555-1212 | {"CharsCount":"46","AttachmentSize":"250","AttachmentType":"jpeg","AttachmentName":"Pic2"} |
| 555-555-1234 | 555-555-1213 | {"CharsCount":"50","AttachmentSize":"300","AttachmentType":"png","AttachmentName":"Pic3"} |
| 555-555-1234 | 555-555-1212 | {"CharsCount":"46","AttachmentSize":"300","AttachmentType":"png","AttachmentName":"Pic3"} |