Strings and regex

Matching, extracting and reshaping text fields.

Matching

Operator	Case	Does
`has`	insensitive	Whole-token match — fastest, use it when you can
`contains`	insensitive	Substring anywhere
`startswith` / `endswith`	insensitive	Prefix / suffix
`matches regex`	sensitive	Full RE2 regex
`in~ (…)`	insensitive	Membership
`==` / `=~`	sensitive / insensitive	Exact equality

has beats contains

has matches on token boundaries and can use block-level metadata to skip storage entirely. contains "error" scans every value; has "error" often reads a fraction of the blocks. Reach for has first.

Extracting

Function	Does
`extract(regex, captureIndex, source)`	One capture group
`extract_all(regex, source)`	Array of all matches
`parse … with`	Positional extraction without regex
`split(source, delimiter)`	Array of parts
`substring(source, start, length)`	Slice
`strcat(a, b, …)`	Concatenate
`replace(regex, replacement, source)`	Substitute
`trim(source)` / `toupper` / `tolower`	Normalise

Pulling structure out of an unstructured message

read top to bottom

1['api-gateway-prod']
2| where message has "pool exhausted"
3| extend used = toint(extract(@"pool exhausted: (\d+)/", 1, message)),
4         cap  = toint(extract(@"/(\d+) connections", 1, message))
5| summarize events = count(), peak = max(used) by service, cap
6| order by events desc

parse, when the format is fixed

For a predictable message shape, parse is faster to write and faster to run than a regex.

LSQL

read top to bottom

1['nginx-access']
2| parse message with ip " - - [" ts "] \"" method " " path " HTTP"
3| summarize hits = count() by path
4| top 10 by hits desc

Regexes are RE2

No backreferences and no lookaround — the trade for guaranteed linear time. A regex that works in PCRE may be rejected here; rewrite it with capture groups or use parse.

PreviousTime and bins NextJoins and lookups