How do I write a Kusto query that uses a regex to filter on a where clause

Question

In Azure Log Analytics I'm trying to use Kusto to query requests with a where condition that uses a regex. The query I'm trying is

requests
| where customDimensions.["API Name"] matches regex "\w*-v\d*"

but this returns a syntax error. The example given in the documentation here is limited but implies that this syntax should work. A simpler version of the above does work

requests
| where customDimensions.["API Name"] matches regex ".*-v.*"

What is the correct syntax for where <predicate> matches regex in Kusto?

score 15 · Accepted Answer · answered Oct 24 '19 at 17:14

15

If the regex contains backslashes then it must be passed as a verbatim string as explained here. The following syntax worked

requests
| where customDimensions.["API Name"] matches regex @'\w*-v\d*'

answered Oct 24 '19 at 17:14

Nick Graham

1,311
3
14
21

How do I write a Kusto query that uses a regex to filter on a where clause

1 Answers1