parse_json()

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Interprets a string as a JSON value and returns the value as dynamic. If possible, the value is converted into relevant data types. For strict parsing with no data type conversion, use extract() or extract_json() functions.

It's better to use the parse_json() function over the extract_json() function when you need to extract more than one element of a JSON compound object. Use dynamic() when possible.

Deprecated aliases: parsejson(), toobject(), todynamic()

Syntax

parse_json(json)

Learn more about syntax conventions.

Parameters

Name Type Required Description
json string ✔️ The string in the form of a JSON-formatted value or a dynamic property bag to parse as JSON.

Returns

An object of type dynamic that is determined by the value of json:

  • If json is of type dynamic, its value is used as-is.
  • If json is of type string, and is a properly formatted JSON string, then the string is parsed, and the value produced is returned.
  • If json is of type string, but it isn't a properly formatted JSON string, then the returned value is an object of type dynamic that holds the original string value.

Examples

The examples in this section show how to use the syntax to help you get started.

Duration metrics parsing

In the following example, when context_custom_metrics is a string that looks like this:

{"duration":{"value":118.0,"count":5.0,"min":100.0,"max":150.0,"stdDev":0.0,"sampledValue":118.0,"sum":118.0}}

Then the following query retrieves the value of the duration slot in the object, and from that it retrieves two slots, duration.value and duration.min (118.0 and 110.0, respectively).

Run the query

datatable(context_custom_metrics:string)
[
    '{"duration":{"value":118.0,"count":5.0,"min":100.0,"max":150.0,"stdDev":0.0,"sampledValue":118.0,"sum":118.0}}'
]
| extend d = parse_json(context_custom_metrics)
| extend duration_value = d.duration.value, duration_min = d.duration.min

Output

context_custom_metrics d duration_value duration_min
{"duration":{"value":118.0,"count":5.0,"min":100.0,"max":150.0,"stdDev":0.0,"sampledValue":118.0,"sum":118.0}} {"duration":{"value":118,"count":5,"min":100,"max":150,"stdDev":0,"sampledValue":118,"sum":118}} 118 100

Nested JSON parsing

It's common to have a JSON string describing a property bag in which one of the "slots" is another JSON string.

For example:

Run the query

let d='{"a":123, "b":"{\\"c\\":456}"}';
print d

Output

print_0
{"a":123, "b":"{"c":456}"}

In such cases, it isn't only necessary to invoke parse_json twice, but also to make sure that in the second call, tostring is used. Otherwise, the second call to parse_json just passes on the input to the output as-is, because its declared type is dynamic.

Run the query

let d='{"a":123, "b":"{\\"c\\":456}"}';
print d_b_c=parse_json(tostring(parse_json(d).b)).c

Ouput

d_b_c
456

Related content