This Id column is dynamic type, but only holds 1 value (f3019…). I want to get rid of the array so it only has the field value.
When I try mv-expand Id it doesn’t do anything
Also the current query is like:
Id = Target.Properties[0].value
When I try
Id = Target.Properties[0].value[0]
Id returns a blank
>Solution :
The dynamic types can hold arrays and dictionaries, but also scalar types.
The fact that Target.Properties[0].value does not behave like an array indicates that it is not an array, but a string.
The representation of it as an array in the GUI relates to the serving lair and not the way it is actually stored.
Use tostring(parse_json(tostring(Target.Properties[0].value))[0]).
- Every element within a dynamic field is also of dynamic type.
When running on a dynamic element, parse_json() returns the element As Is.
If we want the element to get parsed, we first need to convert it to string, using tostring(). - parse_json() which is used to parse the string, returns an array (which is a dynamic element).
- The first (and only) element of the array is also of a dynamic type.
- We use an additional tostring() to convert it to string.
Demo
print value = dynamic('["Hello"]')
| extend value[0] // Null because it's not really an array
| extend result = tostring(parse_json(tostring(value))[0])
| value | value_0 | result |
|---|---|---|
| ["Hello"] | Hello |
Misleading representation in Azure Monitor:
