Kusto查询特定的子记录

Question

有没有办法在Kusto中设置where子句来获取具有子记录的特定记录

就像我想要来自下面的Kyle

其中地址的代码=街道，该值=授予and代码=编号，该值=55555

{
"Firstname": "Bob",
"lastName": "stevens"
"address": [
{
"code": "street",
"value": "Olsen"
},
{
"code": "Number",
"value": "123456"
}
},
{
"Firstname": "Kyle",
"lastName": "richards"
"address": [
{
"code": "street",
"value": "grant"
},
{
"code": "Number",
"value": "55555"
}
}

Answer 1

您可以尝试使用mv-apply，并筛选符合预期条件数量的记录：

datatable(i:int, d:dynamic)
[
1, dynamic({"Firstname": "Bob",  "lastName": "stevens",  "address": [{ "code": "street", "value": "Olsen" }, { "code": "Number", "value": "123456" }]}),
2, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "55555"  }]}),
3, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "11111"  }]})
]
| mv-apply address = d.address on (
summarize c = countif((address.code == 'street' and address.value == 'grant') or 
(address.code == 'Number' and address.value == 55555))
| where c == 2
)
| project-away c

i	d
2	{ "名字"凯尔"代码"："数字"， &"值"："55555&"> } ] }