Kusto Query Specific child records - azure-data-explorer

Question

Is there a way to setup a where clause in Kusto to get specific records with child records
Like if I wanted Kyle from below
Where address has Code = street and that value= grant AND Code = Number and that value= 55555
{
"Firstname": "Bob",
"lastName": "stevens"
"address": [
{
"code": "street",
"value": "Olsen"
},
{
"code": "Number",
"value": "123456"
}
},
{
"Firstname": "Kyle",
"lastName": "richards"
"address": [
{
"code": "street",
"value": "grant"
},
{
"code": "Number",
"value": "55555"
}
}

Answer 1

you could try using mv-apply, and filter for records in which the number of conditions met is as expected:
datatable(i:int, d:dynamic)
[
1, dynamic({"Firstname": "Bob", "lastName": "stevens", "address": [{ "code": "street", "value": "Olsen" }, { "code": "Number", "value": "123456" }]}),
2, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "55555" }]}),
3, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "11111" }]})
]
| mv-apply address = d.address on (
summarize c = countif((address.code == 'street' and address.value == 'grant') or
(address.code == 'Number' and address.value == 55555))
| where c == 2
)
| project-away c
i
d
2
{ "Firstname": "Kyle", "lastName": "richards", "address": [ { "code": "street", "value": "grant" }, { "code": "Number", "value": "55555" } ]}
update: in reply to your comment:
I'm trying to do this with a sproc, Would i need to put this into a datatable then query it like that? If so how do I put a query into a datatable
First, there are no stored procedures in Kusto. there are stored functions.
Second, if you want to invoke a similar logic over an existing table, you can define a stored function that takes a tabular argument as its input. And, optionally, use the invoke operator.
For example:
.create function my_function(T:(d:dynamic)) {
T
| mv-apply address = d.address on (
summarize c = countif((address.code == 'street' and address.value == 'grant') or
(address.code == 'Number' and address.value == 55555))
| where c == 2
)
| project-away c
}
let my_table = datatable(i:int, d:dynamic)
[
1, dynamic({"Firstname": "Bob", "lastName": "stevens", "address": [{ "code": "street", "value": "Olsen" }, { "code": "Number", "value": "123456" }]}),
2, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "55555" }]}),
3, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "11111" }]})
];
my_table
| invoke my_function()