replace_strings()

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Replaces all strings matches with specified strings.

To replace an individual string, see replace_string().

Syntax

replace_strings(text, lookups, rewrites)

Learn more about syntax conventions.

Parameters

Name Type Required Description
text string ✔️ The source string.
lookups dynamic ✔️ The array that includes lookup strings. Array element that isn't a string is ignored.
rewrites dynamic ✔️ The array that includes rewrites. Array element that isn't a string is ignored (no replacement made).

Returns

Returns text after replacing all matches of lookups with evaluations of rewrites. Matches don't overlap.

Examples

Simple replacement

print Message="A magic trick can turn a cat into a dog"
| extend Outcome = replace_strings(
        Message,
        dynamic(['cat', 'dog']), // Lookup strings
        dynamic(['dog', 'pigeon']) // Replacements
        )
Message Outcome
A magic trick can turn a cat into a dog A magic trick can turn a dog into a pigeon

Replacement with an empty string

Replacement with an empty string removes the matching string.

print Message="A magic trick can turn a cat into a dog"
| extend Outcome = replace_strings(
        Message,
        dynamic(['turn', ' into a dog']), // Lookup strings
        dynamic(['disappear', '']) // Replacements
        )
Message Outcome
A magic trick can turn a cat into a dog A magic trick can disappear a cat

Replacement order

The order of match elements matters: the earlier match takes the precedence. Note the difference between Outcome1 and Outcome2: This vs Thwas.

 print Message="This is an example of using replace_strings()"
| extend Outcome1 = replace_strings(
        Message,
        dynamic(['This', 'is']), // Lookup strings
        dynamic(['This', 'was']) // Replacements
        ),
        Outcome2 = replace_strings(
        Message,
        dynamic(['is', 'This']), // Lookup strings
        dynamic(['was', 'This']) // Replacements
        )
Message Outcome1 Outcome2
This is an example of using replace_strings() This was an example of using replace_strings() Thwas was an example of using replace_strings()

Nonstring replacement

Replace elements that aren't strings aren't replaced and the original string is kept. The match is still considered being valid, and other possible replacements aren't performed on the matched string. In the following example, 'This' isn't replaced with the numeric 12345, and it remains in the output unaffected by possible match with 'is'.

 print Message="This is an example of using replace_strings()"
| extend Outcome = replace_strings(
        Message,
        dynamic(['This', 'is']), // Lookup strings
        dynamic([12345, 'was']) // Replacements
        )
Message Outcome
This is an example of using replace_strings() This was an example of using replace_strings()

Related content