如何从 kusto 表创建具有 json 记录的新表答案

【问题标题】：how to create a new table having json record from a kusto table如何从 kusto 表创建具有 json 记录的新表
【发布时间】：2020-04-23 08:23:52
【问题描述】：

我们收到一个多行 json（格式如下），并在使用多行 json 映射后将它们存储到 Kusto 表“OldT”中。

{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:06.077963Z"}
{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:00.893151Z"}

表“OldT”中的记录：

sender      timestamp                   severity    version body    priority    facility    hostname

Test.login  2020-04-23T07:07:06.077963  0           2a09dfa1        1     Test.login
Test.login  2020-04-23T07:07:00.893151Z 0           2a09dfa1        1     Test.login

现在我需要将数据移动到另一个表中，比如“NewT”，只有一列，比如“Rawrecord”

原始记录：

{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:06.077963Z"}
{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:00.893151Z"}

如何将此数据移至NewT？

【问题讨论】：

标签： azure-data-explorer kql

【解决方案1】：

您可以使用pack_all() 函数。例如：

OldT | project Rawrecord = pack_all()

要将其移动到另一个表，您可以使用.set-or-append 命令，例如：

.set-or-append NewT <| OldT | project Rawrecord = pack_all()

【讨论】：