azure - Kusto 正则表达式查询电子邮件

Question

我正在使用以下 Kusto 查询从应用洞察日志导出日志

traces
| extend request = parse_json(tostring(parse_json(customDimensions).PayloadMessage))
| extend message = request.message
| extend SecondaryInfo = request.SecondaryInfo
| extend Logtype = request.Logtype
| extend File = request.File
| extend LineNo = request.LineNo
| extend MemberName = request.MemberName
| extend User = split(split(message,'User(').[1],')').[0]
| project timestamp,message,SecondaryInfo,Logtype,File,LineNo,MemberName,User

我想从消息列中提取电子邮件地址。所以我使用分割操作。但是，我找不到提取电子邮件地址的正确逻辑。有人可以分享一些正则表达式吗？

下面是消息列中的一些值

-MMS.Core.Logging.MmsException: 1012 - Error while fetching Room Booking Requests for (User: <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="71251402053012121e041f054041413117035f151e1c10181f5f121e1c" rel="noreferrer noopener nofollow">[email protected]</a>) at
-MMS.Core.Logging.MmsException: 1011 - Error while fetching User's Locations (<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="aefacbdddaefcdcdc1dbc0da9f9e9eeec8dc80cac1c3cfc7c080cdc1c3" rel="noreferrer noopener nofollow">[email protected]</a>) at"
RbacRepository.GetUserCityBuildings-correlationId-11111fd6-e111-4d11-1111-11e101fbe111--DT-04162021T084110893-- START: (Email:<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="faae9f898ebb9999958f948ecbcacaba9c88d49e95979b9394d4999597" rel="noreferrer noopener nofollow">[email protected]</a>), Cities mapped 4"
RoomBookingDetailsRepository.GetRequestDetailsAsync: Getting the BookingDetails data for User(<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="7b2f1e080f3a1818140e150f4a4b4b3b1d09551f14161a121555181416" rel="noreferrer noopener nofollow">[email protected]</a>), Role(Admin), IsAdmin(True), PPED() Status(), AssignedTo ()"

Answer 1

下面是一个使用简单正则表达式的示例。

如果需要，您可以查看 RE2 的文档进行调整:https://github.com/google/re2/wiki/Syntax

datatable(s:string)
[
    "-MMS.Core.Logging.MmsException: 1012 - Error while fetching Room Booking Requests for (User: <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a9fdccdadde8cacac6dcc7dd989999e9cfdb87cdc6c4c8c0c787cac6c4" rel="noreferrer noopener nofollow">[email protected]</a>) at",
    "-MMS.Core.Logging.MmsException: 1011 - Error while fetching User's Locations (<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="fca8998f88bd9f9f93899288cdccccbc9a8ed29893919d9592d29f9391" rel="noreferrer noopener nofollow">[email protected]</a>) at",
    "RbacRepository.GetUserCityBuildings-correlationId-11111fd6-e111-4d11-1111-11e101fbe111--DT-04162021T084110893-- START: (Email:<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="63370610172200000c160d175253532305114d070c0e020a0d4d000c0e" rel="noreferrer noopener nofollow">[email protected]</a>), Cities mapped 4",
    "RoomBookingDetailsRepository.GetRequestDetailsAsync: Getting the BookingDetails data for User(<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="f6a2938582b7959599839882c7c6c6b69084d892999b979f98d895999b" rel="noreferrer noopener nofollow">[email protected]</a>), Role(Admin), IsAdmin(True), PPED() Status(), AssignedTo ()",
]
| extend email = extract(@"(\w+@\w+\.\w+)", 1, s)