Kusto regex query for email

Question

I am using the below Kusto query for exporting logs from App insight log

traces
| extend request = parse_json(tostring(parse_json(customDimensions).PayloadMessage))
| extend message = request.message
| extend SecondaryInfo = request.SecondaryInfo
| extend Logtype = request.Logtype
| extend File = request.File
| extend LineNo = request.LineNo
| extend MemberName = request.MemberName
| extend User = split(split(message,'User(').[1],')').[0]
| project timestamp,message,SecondaryInfo,Logtype,File,LineNo,MemberName,User

I want to extract the email address from the message column. So I am using split operation. However, I could not find the correct logic to extract the email address. Could someone please share some regex.

Below are some values in the messages column

-MMS.Core.Logging.MmsException: 1012 - Error while fetching Room Booking Requests for (User: [email protected]) at
-MMS.Core.Logging.MmsException: 1011 - Error while fetching User's Locations ([email protected]) at"
RbacRepository.GetUserCityBuildings-correlationId-11111fd6-e111-4d11-1111-11e101fbe111--DT-04162021T084110893-- START: (Email:[email protected]), Cities mapped 4"
RoomBookingDetailsRepository.GetRequestDetailsAsync: Getting the BookingDetails data for User([email protected]), Role(Admin), IsAdmin(True), PPED() Status(), AssignedTo ()"

Yoni L. Yoni L. · Accepted Answer · 2021-04-20T19:42:07

Below is an example that uses a naive regex.

You can go over the documentation for RE2 to adjust it, if required: https://github.com/google/re2/wiki/Syntax

datatable(s:string)
[
    "-MMS.Core.Logging.MmsException: 1012 - Error while fetching Room Booking Requests for (User: [email protected]) at",
    "-MMS.Core.Logging.MmsException: 1011 - Error while fetching User's Locations ([email protected]) at",
    "RbacRepository.GetUserCityBuildings-correlationId-11111fd6-e111-4d11-1111-11e101fbe111--DT-04162021T084110893-- START: (Email:[email protected]), Cities mapped 4",
    "RoomBookingDetailsRepository.GetRequestDetailsAsync: Getting the BookingDetails data for User([email protected]), Role(Admin), IsAdmin(True), PPED() Status(), AssignedTo ()",
]
| extend email = extract(@"(\w+@\w+\.\w+)", 1, s)

Kusto regex query for email

1 Answers