project operator

Selects the fields to insert, rename, include, or drop and embeds new computed columns.

Syntax

| project ColumnName [= Expression] [, ...]
| project FieldName, FieldName, FieldName, ...

or

| project [FieldName, FieldName[,] = Expression [, ...]

Arguments

nametypedescription
Field Name(Column Name)stringName of a Field (column) to appear in the output. If there is no Expression, then Field Name is compulsory and a column of that name must appear in the input
ExpressionexpressionOptional scalar expression referencing the input columns.

Returns

A table that has the field named 'arguments' and as many rows as the input table.

Examples

['http-logs']
| project ['geo.country'] = ['id']
['http-logs']
| project ['geo.country'] = ['id'], method = ['geo.city']
['http-logs']
| project ['geo.city'], content_type, ['geo.country'], ['id'], is_tls

Was this page helpful?