title: How to parse nested JSON, within a string, using Kusto
body: <p>I have a Python Azure Function that produces custom logging messages when the Function executes. I need to pull out some of the JSON values nested in the logging message.</p>
  <p><strong>How can I use Kusto to access the <em>nested</em> JSON within the logging message string?</strong></p>
  <p>Example logging message:</p>
  <ul>
  <li>Desired values marked with <code>&lt;----------</code></li>
  </ul>
  <pre><code>####### EventGrid trigger processing an event: 
      {
          &quot;id&quot;: &quot;long-guid&quot;, 
          &quot;data&quot;: {
              &quot;api&quot;: &quot;FlushWithClose&quot;, 
              &quot;requestId&quot;: &quot;long-guid&quot;, 
              &quot;eTag&quot;: &quot;long-guid&quot;, 
              &quot;contentType&quot;: &quot;application/octet-stream&quot;, 
              &quot;contentLength&quot;: 16264, &lt;----------------------
              &quot;contentOffset&quot;: 0, 
              &quot;blobType&quot;: &quot;BlockBlob&quot;, 
              &quot;blobUrl&quot;: &quot;https://function.blob.core.windows.net/parentdir/childdir/file.name&quot;, 
              &quot;url&quot;: &quot;https://function.dfs.core.windows.net/parentdir/childdir/file.name&quot;, &lt;---- JUST FILE.NAME here
              &quot;sequencer&quot;: &quot;long-guid&quot;, 
              &quot;identity&quot;: &quot;long-guid&quot;, 
              &quot;storageDiagnostics&quot;: {
                  &quot;batchId&quot;: &quot;long-guid&quot;
              }
      }, 
      &quot;topic&quot;: &quot;/subscriptions/long-guid/resourceGroups/resourceGroup/providers/Microsoft.Storage/storageAccounts/accountName&quot;, 
      &quot;subject&quot;: &quot;/blobServices/default/containers/containerName/blobs/childDir/file.name&quot;,
      &quot;event_type&quot;: &quot;Microsoft.Storage.BlobCreated&quot;
  } #######
  
  </code></pre>
  <p>I imagine it has something to do with the Kusto <code>extend</code> function, but piping in...</p>
  <pre><code>| extend parsedMessage = todynamic(message)
  | project timestamp, test = parsedMessage[&quot;id&quot;]
  </code></pre>
  <p>...yields only an empty <code>test</code> column</p>
  <p><a href="https://i.stack.imgur.com/yx4iP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yx4iP.png" alt="enter image description here" /></a></p>