parse 運算子

發行項
09/03/2024

適用於：✅Microsoft網狀架構✅Azure 數據 ✅總管 Azure 監視器 ✅Microsoft Sentinel

評估字串表示式，並將其值剖析成一或多個匯出數據行。匯出數據行會傳回 null 未成功剖析字串的值。如果不需要使用剖析失敗的數據列，偏好使用 parse-where 運算符。

語法

T | parse [ kind [ flags=kind=regexFlags ]] expression with [ * ] stringConstant columnName [ columnType] [: * ] , ...

深入瞭解語法慣例。

參數

姓名	類型	必要	描述
T	`string`	✔️	要剖析的表格式輸入。
種類	`string`	✔️	其中一個支援的種類值。預設值是 `simple`。
regexFlags	`string`		如果 kind 為 `regex`，則您可以指定 regex 旗標，例如 `U` 用於不油、 `m` 多行模式、 `s` 比對新行 `\n`，以及 `i` 不區分大小寫。您可以在 Flags 中找到更多旗標。
expression	`string`	✔️	評估為字串的表達式。
stringConstant	`string`	✔️	要搜尋和剖析的字串常數。
columnName	`string`	✔️	要指派值的數據行名稱，從字串表達式擷取。
columnType	`string`		指示要將值轉換成何種型別的純量值。預設值為 `string`。

注意

除了 StringConstant 之外，剖析模式也可以以 ColumnName 開頭。
在 * 模式中使用來略過垃圾郵件值。 *無法在類型資料string列之後使用。
如果剖析的運算式不是型string別，則會轉換成類型 string 。
如果您要卸除或重新命名某些資料列，請使用 project 。

支援的種類值

Text	描述
`simple`	這是預設值。 stringConstant 是一般字串值，而且比對是 strict。所有字串分隔符號都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`regex`	stringConstant 可以是正則表達式，而且比對是 strict。所有字串分隔符號 (可以是此模式的規則運算式) 都應出現在剖析字串中，而所有擴展資料行皆必須與要求的型別相符。
`relaxed`	stringConstant 是一般字串值，而且比對是寬鬆的。所有字串分隔符都應該出現在剖析的字串中，但擴充數據行可能會部分符合所需的類型。不符合必要類型的擴充數據行會取得值 `null`。

Regex 模式

在 regex 模式中，剖析會將模式轉譯為 regex。使用正則表達式來執行比對，並使用內部處理的編號擷取群組。例如：

parse kind=regex Col with * <regex1> var1:string <regex2> var2:long

在 parse 語句中，剖析在內部產生的 regex 是 .*?<regex1>(.*?)<regex2>(\-\d+)。

* 已轉譯為 .*?。
string 已轉譯為 .*?。
long 已轉譯為 \-\d+。

傳回

輸入資料表將根據提供給運算子的資料行清單以進行擴充。

範例

運算子parse會使用相同string運算式上的多個extract應用程式，為數據表提供簡化的方式extend。當數據表有包含數個 string 您想要分成個別數據行的值時，這個結果很有用。例如，開發人員追蹤（“/printf”“Console.WriteLine）語句所產生的數據行。

剖析和擴充結果

在下列範例中，數據表Traces的數據行EventText包含格式Event: NotifySliceRelease (resourceName={0}, totalSlices={1}, sliceNumber={2}, lockTime={3}, releaseTime={4}, previousLockTime={5})的字串。此工作會使用六個資料行擴充資料表：resourceName、、totalSlicessliceNumber、lockTime、、 releaseTime和 previousLockTime。

執行查詢

let Traces = datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long * "sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *  
| project resourceName, totalSlices, sliceNumber, lockTime, releaseTime, previousLockTime

輸出

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	20	02/17/2016 08:40:01	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

擷取電子郵件別名和 DNS

在下列範例中，會剖析 Contacts 數據表中的專案，以從電子郵件地址擷取別名和網域，以及網站 URL 中的網域。此查詢會 EmailAddress傳回、 EmailAlias和 WebsiteDomain 數據行，其中 fullEmail 數據行會結合剖析的電子郵件別名和網域。

執行查詢

let Leads=datatable(Contacts: string)
    [
    "Event: LeadContact (email=john@contosohotel.com, Website=https:contosohotel.com)",
	"Event: LeadContact (email=abi@fourthcoffee.com, Website=https:www.fourthcoffee.com)",
	"Event: LeadContact (email=nevena@treyresearch.com, Website=https:treyresearch.com)",
	"Event: LeadContact (email=faruk@tailspintoys.com, Website=https:tailspintoys.com)",
	"Event: LeadContact (email=ebere@relecloud.com, Website=https:relecloud.com)",
];
Leads
| parse Contacts with * "email=" alias:string "@" domain: string ", Website=https:" WebsiteDomain: string ")"
| project EmailAddress=strcat(alias, "@", domain), EmailAlias=alias, WebsiteDomain

輸出

EmailAddress	EmailAlias	WebsiteDomain
nevena@treyresearch.com	nevena	treyresearch.com
john@contosohotel.com	John	contosohotel.com
faruk@tailspintoys.com	faruk	tailspintoys.com
ebere@relecloud.com	ebere	relecloud.com
abi@fourthcoffee.com	abi	www.fourthcoffee.com

Regex 模式

在下列範例中，正則表達式可用來剖析和擷取數據行 EventText 中的數據。擷取的數據會投影到新的欄位。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces  
| parse kind=regex EventText with "(.*?)[a-zA-Z]*=" resourceName @", totalSlices=\s*\d+\s*.*?sliceNumber=" sliceNumber: long  ".*?(previous)?lockTime=" lockTime ".*?releaseTime=" releaseTime ".*?previousLockTime=" previousLockTime: date "\\)"  
| project resourceName, sliceNumber, lockTime, releaseTime, previousLockTime

輸出

resourceName	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	15	02/17/2016 08:40:00,	02/17/2016 08:40:00,	2016-02-17 08:39:00.0000000
PipelineScheduler	23	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	20	02/17/2016 08:40:01,	02/17/2016 08:40:01,	2016-02-17 08:39:01.0000000
PipelineScheduler	16	02/17/2016 08:41:00,	02/17/2016 08:41:00,	2016-02-17 08:40:00.0000000
PipelineScheduler	22	02/17/2016 08:41:01,	02/17/2016 08:41:00,	2016-02-17 08:40:01.0000000

具有 regex 旗標的 Regex 模式

在下列範例 resourceName 中，會擷取。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex EventText with * "resourceName=" resourceName ',' *
| project resourceName

輸出

resourceName
PipelineScheduler， totalSlices=27， sliceNumber=23， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=15， lockTime=02/17/2016 08：40：00， releaseTime=02/17/2016 08：40：00
PipelineScheduler， totalSlices=27， sliceNumber=20， lockTime=02/17/2016 08：40：01， releaseTime=02/17/2016 08：40：01
PipelineScheduler， totalSlices=27， sliceNumber=22， lockTime=02/17/2016 08：41：01， releaseTime=02/17/2016 08：41：00
PipelineScheduler， totalSlices=27， sliceNumber=16， lockTime=02/17/2016 08：41：00， releaseTime=02/17/2016 08：41：00

如果有記錄 resourceName 有時會顯示為小寫，有時顯示為大寫，您可能會取得某些值的 Null。

上一個範例的結果是非預期的，而且包含完整的事件數據，因為預設模式很窮。若要只 resourceName擷取，請使用非窮盡 U執行上一個查詢，並停用區分大小寫 i 的 regex 旗標。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=Ui EventText with * "RESOURCENAME=" resourceName ',' *
| project resourceName

輸出

resourceName
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler
PipelineScheduler

如果剖析的字串有換行符，請使用旗標 s來剖析文字。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=23\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=15\nlockTime=02/17/2016 08:40:00\nreleaseTime=02/17/2016 08:40:00\npreviousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=20\nlockTime=02/17/2016 08:40:01\nreleaseTime=02/17/2016 08:40:01\npreviousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=22\nlockTime=02/17/2016 08:41:01\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler\ntotalSlices=27\nsliceNumber=16\nlockTime=02/17/2016 08:41:00\nreleaseTime=02/17/2016 08:41:00\npreviousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=regex flags=s EventText with * "resourceName=" resourceName: string "(.*?)totalSlices=" totalSlices: long "(.*?)lockTime=" lockTime: datetime "(.*?)releaseTime=" releaseTime: datetime "(.*?)previousLockTime=" previousLockTime: datetime "\\)" 
| project-away EventText

輸出

resourceName	totalSlices	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	2016-02-17 08:40:00.0000000	2016-02-17 08:40:00.0000000	2016-02-17 08:39:00.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:40:01.0000000	2016-02-17 08:40:01.0000000	2016-02-17 08:39:01.0000000
PipelineScheduler	27	2016-02-17 08:41:00.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	2016-02-17 08:41:01.0000000	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

寬鬆模式

在下列寬鬆模式範例中，擴充資料行 totalSlices 的類型必須為 long。不過，在剖析的字串中，它具有值 nonValidLongValue。對於擴充資料行，releaseTimenonValidDateTime值無法剖析為 datetime。這兩個擴充數據行會產生 null 值，而其他數據行，例如 sliceNumber，仍然會產生正確的值。

如果您使用下列查詢的選項 kind = simple ，則會取得 null 所有擴充數據行的結果。此選項在擴充數據行上是嚴格的，而且是寬鬆和簡單模式之間的差異。

注意

在寬鬆模式中，擴充數據行可以部分比對。

執行查詢

let Traces=datatable(EventText: string)
    [
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=nonValidDateTime, previousLockTime=02/17/2016 08:39:00)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=nonValidDateTime 08:40:01, previousLockTime=02/17/2016 08:39:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
    "Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=nonValidLongValue, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| parse kind=relaxed EventText with * "resourceName=" resourceName ", totalSlices=" totalSlices: long ", sliceNumber=" sliceNumber: long * "lockTime=" lockTime ", releaseTime=" releaseTime: date "," * "previousLockTime=" previousLockTime: date ")" *
| project-away EventText

輸出

resourceName	totalSlices	sliceNumber	lockTime	releaseTime	previousLockTime
PipelineScheduler	27	15	02/17/2016 08:40:00		2016-02-17 08:39:00.0000000
PipelineScheduler	27	23	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		20	02/17/2016 08:40:01		2016-02-17 08:39:01.0000000
PipelineScheduler		16	02/17/2016 08:41:00	2016-02-17 08:41:00.0000000	2016-02-17 08:40:00.0000000
PipelineScheduler	27	22	02/17/2016 08:41:01	2016-02-17 08:41:00.0000000	2016-02-17 08:40:01.0000000

共用方式為

parse 運算子

語法

參數

支援的種類值

Regex 模式

傳回

範例

剖析和擴充結果

擷取電子郵件別名和 DNS

Regex 模式

具有 regex 旗標的 Regex 模式

寬鬆模式

意見反應

其他資源

共用方式為

parse 運算子

語法

參數

支援的種類值

Regex 模式

傳回

範例

剖析和擴充結果

擷取電子郵件別名和 DNS

Regex 模式

具有 regex 旗標的 Regex 模式

寬鬆模式

相關內容

意見反應

其他資源