下面是 kusto 查询:
ADFActivityRun
| where PipelineName contains "MyPipeline"
| where OperationName == "Failed"
| order by TimeGenerated desc
| take 1
"输出"列给出以下结果:
"{
""name"": ""varFileNames"",
""value"": [
{
""name"": ""Z400_EEE_20191110_ERR.txt"",
""type"": ""File""
},
{
""name"": ""Z400_CCC_20191119_ERR.txt"",
""type"": ""File""
},
{
""name"": ""Z400_DDD_20191121_ERR.txt"",
""type"": ""File""
},
{
""name"": ""Z400_EEE_20191122_ERR.txt"",
""type"": ""File""
},
{
""name"": ""Z400_AAA_20191202_ERR.txt"",
""type"": ""File""
}
]
}"
文件名中包含 yyyymmdd。我只想获取最新的文本文件名。在上述情况下 - Z400_AAA_20191202_ERR.txt
目的是发送警报 - "上述错误文件可用,请检查此文件">
您可以使用mv-apply
来实现这一点。
例如:
print d = dynamic({
"name": "varFileNames",
"value": [
{
"name": "Z400_EEE_20191110_ERR.txt",
"type": "File"
},
{
"name": "Z400_CCC_20191119_ERR.txt",
"type": "File"
},
{
"name": "Z400_DDD_20191121_ERR.txt",
"type": "File"
},
{
"name": "Z400_EEE_20191122_ERR.txt",
"type": "File"
},
{
"name": "Z400_AAA_20191202_ERR.txt",
"type": "File"
}
]
})
| mv-apply value = d.value on (
parse value.name with * "_" * "_" dt:datetime "_" *
| top 1 by dt desc
| project name = value.name
)
| project name