Kusto分组AppInsights消息查询

Question

我需要在Azure AppInsights中的消息，通过消息中存在的特定子字符串和这些消息的计数进行分组。

最后，分组将如下所示

messages                                  count
--------                                   -------
foomessages                               <say, 300>
barmessages                               <say, 450>
:
:

哪里

foomessages = All messages containing the substring "foo" etc.

我该如何构造一个查询呢？

Answer 1

datatable(log: string) [
    "hello world",
    "this is a test",
    "this is a world test",
    "another test"
]
| summarize
    LogsWithWorld = countif(log has "world"),
    LogsWithTest = countif(log has "test")
| project Result = pack_all()
| mv-expand Result
| extend Message = tostring(bag_keys(Result)[0])
| extend Count = tolong(Result[Message])
| project Message, Count

产生的结果是：

| Message       | Count |
|---------------|-------|
| LogsWithWorld | 2     |
| LogsWithTest  | 3     |
|---------------|-------|