解析運算子

Apply to： ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

評估字串表示式，並將其值剖析成一或多個匯出數據行。匯出數據行會傳回 null 未成功剖析字串的值。如果不需要使用解析失敗的列，建議使用解析-位置運算子。

Syntax

T| parse [ kind=類型 [ flags=正統表達旗標 ]] 表達式with [ * ] string 常數列名 [:columnType] [ * ] ... ,

Parameters

Name	類型	Required	Description
T	`string`	✔️	要剖析的表格式輸入。
kind	`string`	✔️	其中一個支援的種類值。預設值是 `simple`。
regexFlags	`string`		如果類型為 `regex`，則你可以指定正`U`則表達式旗標，如 unreedy、`m`多行模式、`s`匹配新行 `\n`以及`i`大小寫不區分。更多旗幟可在旗幟部分找到。
expression	`string`	✔️	評估為字串的表達式。
stringConstant	`string`	✔️	要搜尋和剖析的字串常數。
columnName	`string`	✔️	要指派值的數據行名稱，從字串表達式擷取。
columnType	`string`		指示要將值轉換成何種型別的純量值。預設值為 `string`。

Note

解析模式可以從 ColumnName 和 StringConstant 開始。
在 * 模式中使用來略過垃圾郵件值。 *無法在類型資料string列之後使用。
若解析後的表達式不是型別 string，則會轉換成型別 string。
如果您要卸除或重新命名某些資料列，請使用 project 。

支援的 `kind` 值

文字	Description
`simple`	這是預設值。 stringConstant 是一般字串值，且匹配是嚴格的。所有字串分隔符號都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`regex`	stringConstant 可以是正則表達式，且匹配是嚴格的。所有字串分隔符號 (可以是此模式的規則運算式) 都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`relaxed`	stringConstant 是規則字串值，匹配度會被放寬。所有字串分隔符都應該出現在剖析的字串中，但擴充數據行可能會部分符合所需的類型。不符合必要類型的擴充數據行會取得值 `null`。

正則表達式模式

在 regex 模式中，剖析會將模式轉譯為 regex。使用正規表達式來做匹配，並使用內部處理的編號捕捉群組。例如：

parse kind=regex Col with * <regex1> var1:string <regex2> var2:long

在 parse 語句中，剖析在內部產生的 regex 是 .*?<regex1>(.*?)<regex2>(\-\d+)。

* 已轉譯為 .*?。
string 已轉譯為 .*?。
long 已轉譯為 \-\d+。

Returns

輸入資料表將根據提供給運算子的資料行清單以進行擴充。

Examples

本節中的範例示範如何使用語法來協助您開始使用。

本文中的範例會使用說明叢集中公開可用的資料表，例如 StormEvents[範例] 資料庫中的資料表。

本文中的範例使用公開可用的資料表，例如 Weather Weather analytics 範例資源庫中的資料表。您可能需要修改範例查詢中的資料表名稱，以符合工作區中的資料表。

運算子parse會使用相同extend運算式上的多個extract應用程式，為數據表提供簡化的方式string。當數據表有包含數個 string 您想要分成個別數據行的值時，這個結果很有用。例如，開發人員追蹤（“/printf”“Console.WriteLine）語句所產生的數據行。

剖析和擴充結果

在下列範例中，數據表EventText的數據行Traces包含格式Event: NotifySliceRelease (resourceName={0}, totalSlices={1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5})的字串。此工作會使用六個資料行擴充資料表：resourceName、、totalSlicessliceNumber、lockTime、、 releaseTime和 previousLockTime。

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long * "sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *  
| project resourceName, totalSlices, sliceNumber, lockTime, releaseTime, previousLockTime

Output

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	20	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

擷取電子郵件別名和 DNS

以下範例中，從聯絡人資料表中解析別名與網域，從電子郵件地址擷取別名與網域，並從網站網址擷取網域。此查詢會 EmailAddress傳回、 EmailAlias和 WebsiteDomain 數據行，其中 fullEmail 數據行會結合剖析的電子郵件別名和網域。

執行查詢

let Leads=datatable(Contacts: string)
    [
    "Event: LeadContact (email=john@contosohotel.com, Website=https:contosohotel.com)",
	"Event: LeadContact (email=abi@fourthcoffee.com, Website=https:www.fourthcoffee.com)",
	"Event: LeadContact (email=nevena@treyresearch.com, Website=https:treyresearch.com)",
	"Event: LeadContact (email=faruk@tailspintoys.com, Website=https:tailspintoys.com)",
	"Event: LeadContact (email=ebere@relecloud.com, Website=https:relecloud.com)",
];
Leads
| parse Contacts with * "email=" alias:string "@" domain: string ", Website=https:" WebsiteDomain: string ")"
| project EmailAddress=strcat(alias, "@", domain), EmailAlias=alias, WebsiteDomain

Output

EmailAddress	EmailAlias	WebsiteDomain
nevena@treyresearch.com	nevena	treyresearch.com
john@contosohotel.com	john	contosohotel.com
faruk@tailspintoys.com	faruk	tailspintoys.com
ebere@relecloud.com	ebere	relecloud.com
abi@fourthcoffee.com	abi	www.fourthcoffee.com

正則表達式模式

在下列範例中，正則表達式可用來剖析和擷取數據行 EventText 中的數據。擷取的數據會投影到新的欄位。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse kind=regex EventText with "(.*?)[a-zA-Z]*=" resourceName @", totalSlices=\s*\d+\s*.*?sliceNumber=" sliceNumber: long  ".*?(previous)?lockTime=" lockTime ".*?releaseTime=" releaseTime ".*?previousLockTime=" previousLockTime: date "\\)"  
| project resourceName, sliceNumber, lockTime, releaseTime, previousLockTime

Output

resourceName	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	15	02/17/2016 08:40:00,	02/17/2016 08:40:00,	2016-02-17 08:39:00.0000000
PipelineScheduler	23	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	20	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	16	02/17/2016 08:41:00,	02/17/2016 08:41:00,	2016-02-17 08:40:00.0000000
PipelineScheduler	22	02/17/2016 08:41:01,	02/17/2016 08:41:00,	2016-02-17 08:40:01.0000000

具有 regex 旗標的 Regex 模式

在下列範例 resourceName 中，會擷取。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex EventText with * "resourceName=" resourceName ',' *
| project resourceName

Output

resourceName
PipelineScheduler， totalSlices=27， sliceNumber=23， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=15， lockTime=02/17/2016 08：40：00， releaseTime=02/17/2016 08：40：00
PipelineScheduler， totalSlices=27， sliceNumber=20， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=22， lockTime=02/17/2016 08：41：01， releaseTime=02/17/2016 08：41：00
PipelineScheduler， totalSlices=27， sliceNumber=16， lockTime=02/17/2016 08：41：00， releaseTime=02/17/2016 08：41：00

如果有記錄 resourceName 有時會顯示為小寫，有時顯示為大寫，您可能會取得某些值的 Null。

上一個範例的結果是非預期的，而且包含完整的事件數據，因為預設模式很窮。若要只 resourceName擷取，請使用非窮盡 U執行上一個查詢，並停用區分大小寫 i 的 regex 旗標。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=Ui EventText with * "RESOURCENAME=" resourceName ',' *
| project resourceName

Output

resourceName
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler

如果剖析的字串有換行符，請使用旗標 s來剖析文字。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=23\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=15\nlockTime=02/17/2016 08:40:00\nreleaseTime=02/17/2016 08:40:00\npreviousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=20\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=22\nlockTime=02/17/2016 08:41:01\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=16\nlockTime=02/17/2016 08:41:00\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=s EventText with * "resourceName=" resourceName: string "(.*?)totalSlices=" totalSlices: long "(.*?)lockTime=" lockTime: datetime "(.*?)releaseTime=" releaseTime: datetime "(.*?)previousLockTime=" previousLockTime: datetime "\\)" 
| project-away EventText

Output

resourceName	totalSlices	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	2016-02-17 08:40:00.0000000	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:41:00.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	2016-02-17 08:41:01.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

放鬆模式

在下列寬鬆模式範例中，擴充資料行 totalSlices 的類型必須為 long。不過，在剖析的字串中，它具有值 nonValidLongValue。對於擴充資料行，releaseTimenonValidDateTime值無法剖析為 datetime。這兩個擴充數據行會產生 null 值，而其他數據行，例如 sliceNumber，仍然會產生正確的值。

如果您使用下列查詢的選項 kind = simple ，則會取得 null 所有擴充數據行的結果。此選項在擴充數據行上是嚴格的，而且是寬鬆和簡單模式之間的差異。

Note

在寬鬆模式中，擴充數據行可以部分比對。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=nonValidDateTime, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=relaxed EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *
| project-away EventText

Output

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00		2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		20	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

parse-json function
萃取函數
全取出函數
extract-json 函式

意見反應

此頁面對您有幫助嗎？

Last updated on 2026-02-05

共用方式為

解析運算子

Syntax

Parameters

支援的 kind 值

正則表達式模式

Returns

Examples

剖析和擴充結果

擷取電子郵件別名和 DNS

正則表達式模式

具有 regex 旗標的 Regex 模式

放鬆模式

相關內容

意見反應

其他資源

支援的 `kind` 值