parse operator

Applies to: ✅Microsoft Fabric✅Azure Data Explorer✅Azure Monitor✅Microsoft Sentinel

評估字串表示式，並將其值剖析成一或多個匯出數據行。匯出數據行會傳回 null 未成功剖析字串的值。 If there's no need to use rows where parsing doesn't succeed, prefer using the parse-where operator.

Syntax

T| parse [ kind=kind [ flags=regexFlags ]] expressionwith [ * ] stringConstantcolumnName [:columnType] [ * ] , ...

Learn more about syntax conventions.

Parameters

Name	類型	Required	Description
T	`string`	✔️	要剖析的表格式輸入。
kind	`string`	✔️	其中一個支援的種類值。預設值是 `simple`。
regexFlags	`string`		If kind is `regex`, then you can specify regex flags to be used like `U` for ungreedy, `m` for multi-line mode, `s` for match new line `\n`, and `i` for case-insensitive. More flags can be found in Flags.
expression	`string`	✔️	評估為字串的表達式。
stringConstant	`string`	✔️	要搜尋和剖析的字串常數。
columnName	`string`	✔️	要指派值的數據行名稱，從字串表達式擷取。
columnType	`string`		指示要將值轉換成何種型別的純量值。預設值為 `string`。

Note

The parse pattern can start with ColumnName in addition to StringConstant.
在 * 模式中使用來略過垃圾郵件值。 *無法在類型資料string列之後使用。
If the parsed expression isn't of type string, it will be converted to type string.
如果您要卸除或重新命名某些資料列，請使用 project 。

支援的 `kind` 值

文字	Description
`simple`	這是預設值。 stringConstant is a regular string value and the match is strict. 所有字串分隔符號都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`regex`	stringConstant can be a regular expression and the match is strict. 所有字串分隔符號 (可以是此模式的規則運算式) 都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`relaxed`	stringConstant is a regular string value and the match is relaxed. 所有字串分隔符都應該出現在剖析的字串中，但擴充數據行可能會部分符合所需的類型。不符合必要類型的擴充數據行會取得值 `null`。

Regex mode

在 regex 模式中，剖析會將模式轉譯為 regex。 Use regular expressions to do the matching and use numbered captured groups that are handled internally. For example:

parse kind=regex Col with * <regex1> var1:string <regex2> var2:long

在 parse 語句中，剖析在內部產生的 regex 是 .*?<regex1>(.*?)<regex2>(\-\d+)。

* 已轉譯為 .*?。
string 已轉譯為 .*?。
long 已轉譯為 \-\d+。

Returns

輸入資料表將根據提供給運算子的資料行清單以進行擴充。

Examples

本節中的範例示範如何使用語法來協助您開始使用。

The examples in this article use publicly available tables in the help cluster, such as the StormEvents table in the Samples database.

The examples in this article use publicly available tables, such as the Weather table in the Weather analytics sample gallery. 您可能需要修改範例查詢中的資料表名稱，以符合工作區中的資料表。

運算子parse會使用相同extend運算式上的多個extract應用程式，為數據表提供簡化的方式string。當數據表有包含數個 string 您想要分成個別數據行的值時，這個結果很有用。例如，開發人員追蹤（“/printf”“Console.WriteLine）語句所產生的數據行。

剖析和擴充結果

在下列範例中，數據表EventText的數據行Traces包含格式Event: NotifySliceRelease (resourceName={0}, totalSlices={1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5})的字串。此工作會使用六個資料行擴充資料表：resourceName、、totalSlicessliceNumber、lockTime、、 releaseTime和 previousLockTime。

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long * "sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *  
| project resourceName, totalSlices, sliceNumber, lockTime, releaseTime, previousLockTime

Output

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	20	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

擷取電子郵件別名和 DNS

In the following example, entries from the Contacts table are parsed to extract the alias and domain from an email address, and the domain from a website URL. 此查詢會 EmailAddress傳回、 EmailAlias和 WebsiteDomain 數據行，其中 fullEmail 數據行會結合剖析的電子郵件別名和網域。

執行查詢

let Leads=datatable(Contacts: string)
    [
    "Event: LeadContact (email=john@contosohotel.com, Website=https:contosohotel.com)",
	"Event: LeadContact (email=abi@fourthcoffee.com, Website=https:www.fourthcoffee.com)",
	"Event: LeadContact (email=nevena@treyresearch.com, Website=https:treyresearch.com)",
	"Event: LeadContact (email=faruk@tailspintoys.com, Website=https:tailspintoys.com)",
	"Event: LeadContact (email=ebere@relecloud.com, Website=https:relecloud.com)",
];
Leads
| parse Contacts with * "email=" alias:string "@" domain: string ", Website=https:" WebsiteDomain: string ")"
| project EmailAddress=strcat(alias, "@", domain), EmailAlias=alias, WebsiteDomain

Output

EmailAddress	EmailAlias	WebsiteDomain
nevena@treyresearch.com	nevena	treyresearch.com
john@contosohotel.com	john	contosohotel.com
faruk@tailspintoys.com	faruk	tailspintoys.com
ebere@relecloud.com	ebere	relecloud.com
abi@fourthcoffee.com	abi	www.fourthcoffee.com

Regex mode

在下列範例中，正則表達式可用來剖析和擷取數據行 EventText 中的數據。擷取的數據會投影到新的欄位。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse kind=regex EventText with "(.*?)[a-zA-Z]*=" resourceName @", totalSlices=\s*\d+\s*.*?sliceNumber=" sliceNumber: long  ".*?(previous)?lockTime=" lockTime ".*?releaseTime=" releaseTime ".*?previousLockTime=" previousLockTime: date "\\)"  
| project resourceName, sliceNumber, lockTime, releaseTime, previousLockTime

Output

resourceName	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	15	02/17/2016 08:40:00,	02/17/2016 08:40:00,	2016-02-17 08:39:00.0000000
PipelineScheduler	23	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	20	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	16	02/17/2016 08:41:00,	02/17/2016 08:41:00,	2016-02-17 08:40:00.0000000
PipelineScheduler	22	02/17/2016 08:41:01,	02/17/2016 08:41:00,	2016-02-17 08:40:01.0000000

具有 regex 旗標的 Regex 模式

在下列範例 resourceName 中，會擷取。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex EventText with * "resourceName=" resourceName ',' *
| project resourceName

Output

resourceName
PipelineScheduler， totalSlices=27， sliceNumber=23， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=15， lockTime=02/17/2016 08：40：00， releaseTime=02/17/2016 08：40：00
PipelineScheduler， totalSlices=27， sliceNumber=20， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=22， lockTime=02/17/2016 08：41：01， releaseTime=02/17/2016 08：41：00
PipelineScheduler， totalSlices=27， sliceNumber=16， lockTime=02/17/2016 08：41：00， releaseTime=02/17/2016 08：41：00

如果有記錄 resourceName 有時會顯示為小寫，有時顯示為大寫，您可能會取得某些值的 Null。

上一個範例的結果是非預期的，而且包含完整的事件數據，因為預設模式很窮。若要只 resourceName擷取，請使用非窮盡 U執行上一個查詢，並停用區分大小寫 i 的 regex 旗標。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=Ui EventText with * "RESOURCENAME=" resourceName ',' *
| project resourceName

Output

resourceName
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler

如果剖析的字串有換行符，請使用旗標 s來剖析文字。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=23\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=15\nlockTime=02/17/2016 08:40:00\nreleaseTime=02/17/2016 08:40:00\npreviousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=20\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=22\nlockTime=02/17/2016 08:41:01\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=16\nlockTime=02/17/2016 08:41:00\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=s EventText with * "resourceName=" resourceName: string "(.*?)totalSlices=" totalSlices: long "(.*?)lockTime=" lockTime: datetime "(.*?)releaseTime=" releaseTime: datetime "(.*?)previousLockTime=" previousLockTime: datetime "\\)" 
| project-away EventText

Output

resourceName	totalSlices	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	2016-02-17 08:40:00.0000000	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:41:00.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	2016-02-17 08:41:01.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

Relaxed mode

在下列寬鬆模式範例中，擴充資料行 totalSlices 的類型必須為 long。不過，在剖析的字串中，它具有值 nonValidLongValue。對於擴充資料行，releaseTimenonValidDateTime值無法剖析為 datetime。這兩個擴充數據行會產生 null 值，而其他數據行，例如 sliceNumber，仍然會產生正確的值。

如果您使用下列查詢的選項 kind = simple ，則會取得 null 所有擴充數據行的結果。此選項在擴充數據行上是嚴格的，而且是寬鬆和簡單模式之間的差異。

Note

在寬鬆模式中，擴充數據行可以部分比對。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=nonValidDateTime, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=relaxed EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *
| project-away EventText

Output

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00		2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		20	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

parse-json function
extract function
extract-all function
extract-json function

意見反應

此頁面對您有幫助嗎？

Last updated on 2025-07-20

共用方式為

parse operator

Syntax

Parameters

支援的 kind 值

Regex mode

Returns

Examples

剖析和擴充結果

擷取電子郵件別名和 DNS

Regex mode

具有 regex 旗標的 Regex 模式

Relaxed mode

Related content

意見反應

其他資源

支援的 `kind` 值