azure - Kusto 查询语言 : Get keyword that was matched (has_any)

Question

我正在 KQL 中提供一个 csv 文件作为外部数据源。我运行查询来匹配列:

Events | where Title has_any (ColumnName) | project Title, EventId

现在，我想将输出与匹配的列值连接起来。就像列有值一样:上面的查询中匹配了“test”、“test2”、“test3”和“test2”，结果表应该类似于:

Title,EventId,MatchedColumnValue

请帮忙

Answer 1

以下是如何使用has_any_index()来做到这一点功能:

let Values = dynamic(["title1", "title2", "title3"]);
let Events = datatable(EventId:int, Title:string)[1,"this is title2, and its boring", 2, "title3 is great", 3, "Nothing to find"];
Events
| extend Idx = has_any_index(Title, Values)
| extend MatchedTitle = iif(Idx<0, "", tostring(Values[Idx]))
| project-away Idx