parse_pair

Use the parse_pair function to parse a string containing a key-value pair into its constituent key and value components. This function is useful when you need to extract structured data from strings that follow a key-value format, such as tags, labels, or configuration entries.

Use parse_pair when you have strings like host:server1 or env=production and need to access the key or value individually for filtering, grouping, or analysis.

Usage#

Syntax#

parse_pair(pair_string, [separator])

Parameters#

Returns#

A dynamic object with the following properties:

• key: The extracted key portion of the pair.
• value: The extracted value portion of the pair.
• separator: The separator used in the pair.

If the separator isn't found in the input string, the function returns a pair with the entire input as the value and an empty key.

Example#

Extract and analyze tag components from HTTP request metadata.

Query

['sample-http-logs']
| extend tag_string = strcat('method:', method)
| extend parsed = parse_pair(tag_string)
| project _time, uri, tag_string, parsed

Run in Playground

Output

This query constructs tag strings and then parses them to extract individual key and value components for analysis.

List of related functions#

• pair: Creates a pair string from key and value components. Use parse_pair to decompose existing pairs.
• find_pair: Searches an array of pairs for a matching pattern. Use parse_pair when you need to extract components from a single pair string.
• split: Splits a string by a delimiter into an array. Use parse_pair when you specifically need key-value extraction with structured output.
• extract: Extracts substrings using regex. Use parse_pair for simpler key-value parsing without regex.

Other query languages#