replace_strings()
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Replaces all strings matches with specified strings.
To replace an individual string, see replace_string().
Syntax
replace_strings(
text,
lookups,
rewrites)
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
text | string |
✔️ | The source string. |
lookups | dynamic |
✔️ | The array that includes lookup strings. Array element that isn't a string is ignored. |
rewrites | dynamic |
✔️ | The array that includes rewrites. Array element that isn't a string is ignored (no replacement made). |
Returns
Returns text after replacing all matches of lookups with evaluations of rewrites. Matches don't overlap.
Examples
Simple replacement
print Message="A magic trick can turn a cat into a dog"
| extend Outcome = replace_strings(
Message,
dynamic(['cat', 'dog']), // Lookup strings
dynamic(['dog', 'pigeon']) // Replacements
)
Message | Outcome |
---|---|
A magic trick can turn a cat into a dog | A magic trick can turn a dog into a pigeon |
Replacement with an empty string
Replacement with an empty string removes the matching string.
print Message="A magic trick can turn a cat into a dog"
| extend Outcome = replace_strings(
Message,
dynamic(['turn', ' into a dog']), // Lookup strings
dynamic(['disappear', '']) // Replacements
)
Message | Outcome |
---|---|
A magic trick can turn a cat into a dog | A magic trick can disappear a cat |
Replacement order
The order of match elements matters: the earlier match takes the precedence.
Note the difference between Outcome1 and Outcome2: This
vs Thwas
.
print Message="This is an example of using replace_strings()"
| extend Outcome1 = replace_strings(
Message,
dynamic(['This', 'is']), // Lookup strings
dynamic(['This', 'was']) // Replacements
),
Outcome2 = replace_strings(
Message,
dynamic(['is', 'This']), // Lookup strings
dynamic(['was', 'This']) // Replacements
)
Message | Outcome1 | Outcome2 |
---|---|---|
This is an example of using replace_strings() | This was an example of using replace_strings() | Thwas was an example of using replace_strings() |
Nonstring replacement
Replace elements that aren't strings aren't replaced and the original string is kept. The match is still considered being valid, and other possible replacements aren't performed on the matched string. In the following example, 'This' isn't replaced with the numeric 12345
, and it remains in the output unaffected by possible match with 'is'.
print Message="This is an example of using replace_strings()"
| extend Outcome = replace_strings(
Message,
dynamic(['This', 'is']), // Lookup strings
dynamic([12345, 'was']) // Replacements
)
Message | Outcome |
---|---|
This is an example of using replace_strings() | This was an example of using replace_strings() |
Related content
- For a replacement of a single string, see replace_string().
- For a replacement based on regular expression, see replace_regex().
- For replacing a set of characters, see translate().