Use the todynamic function to parse a string as a dynamic value, such as a JSON object or array. This function is especially useful when your dataset contains structured data in string format and you want to access nested elements, iterate over arrays, or use dynamic-aware functions. You often find todynamic helpful when working with logs, telemetry, or security events that encode rich metadata or nested attributes in stringified JSON. By converting these strings into dynamic values, you can query, filter, and transform the nested fields using APL’s built-in support for dynamic types.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

​
Usage

​
Syntax

todynamic(value)

​
Parameters

NameTypeDescription
valuestringA string representing a JSON-encoded object or array.

​
Returns

A dynamic value. If the input is not a valid JSON string, the function returns null.

​
Example

You want to find events that match certain criteria such as URI and status code. The criteria are stored in a stringified dictionary. Query 
['sample-http-logs']
| extend criteria = '{"uri": "/api/v1/customer/services", "status": "200"}'
| extend metadata = todynamic(criteria)
| where uri == metadata.uri and status == metadata.status
| project _time, id
Run in Playground Output
_timeid
Jun 24, 09:28:102f2e5c40-1094-4237-a124-ec50fab7e726
Jun 24, 09:28:100f9724cb-fa9a-4a2f-bdf6-5c32b2f22efd
Jun 24, 09:28:10a516c4e9-2ed9-4fb9-a191-94e2844e9b2a
  • pack_array: Use this to combine scalar values into an array. Use pack_array when you don’t need named keys and want positional data instead.
  • bag_keys: Returns the list of keys in a dynamic dictionary. Use this to inspect or filter contents created by pack_dictionary.
  • bag_pack: Expands a dictionary into multiple columns. Use it to revert the packing performed by pack_dictionary.