Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Check if string starts with prefix list in KQL

I would like to check in KQL (Kusto Query Language) if a string starts with any prefix that is contained in a list.

Something like:

let MaxAge = ago(30d);
let prefix_list = pack_array(
    'Mr',
    'Ms',
    'Mister',
    'Miss'
);
| where Name startswith(prefix_list)

I know this example can be done with startswith("Mr","Ms","Mister","Miss") but this is not escalable.

like image 485
Daniel Avatar asked Sep 13 '25 21:09

Daniel


1 Answers

an inefficient but functional option would be using matches regex - this can work well if the input data set is not too large:

let T = datatable(Name:string)
[
    "hello" ,'world', "Mra", "Ms 2", "Miz", 'Missed'
]
;
let prefix_list = pack_array(
    'Mr',
    'Ms',
    'Mister',
    'Miss'
);
let prefix_regex = strcat("^(", strcat_array(prefix_list, ")|("), ")");
T
| where Name matches regex prefix_regex
Name
Mra
Ms 2
Missed
like image 160
Yoni L. Avatar answered Sep 16 '25 19:09

Yoni L.