regex_quote

You want to find requests where the uri contains an exact match of a user-provided pattern, such as /api/v1/users[1], which includes regex metacharacters. Use regex_quote to safely escape the pattern before matching.

Query

let pattern = '/api/v1/users[1]';
['sample-http-logs']
| where uri matches regex regex_quote(pattern)
| project _time, id, uri, status

Output

This query searches for logs where the uri exactly matches the string /api/v1/users[1], without interpreting [1] as a character class.

You want to isolate spans whose trace_id includes a literal substring that happens to resemble a regex pattern, such as abc.def[0]. Using regex_quote ensures the pattern is treated literally.

Query

let search_id = 'abc.def[0]';
['otel-demo-traces']
| where trace_id matches regex regex_quote(search_id)
| project _time, trace_id, span_id, ['service.name'], duration

Output

This query avoids misinterpretation of [0] as a regex character class and treats the whole trace_id literally.

You want to scan for potential path traversal attempts where a user’s input includes strings like ..\..\windows\system32. To search this string safely, you use regex_quote.

Query

let attack_pattern = '../../windows/system32';
['sample-http-logs']
| where uri matches regex regex_quote(attack_pattern)
| project _time, id, uri, status, ['geo.country']

Output

This query detects malicious-looking strings literally, without treating . as a wildcard.