title: How to i expand JSON data in kusto/data explorer that has multiple layers?
body: <p>I am trying to ingest JSON array data (specifically the 'Objects' array) into Azure data explorer, as per this Microsoft article. (Only the JSON Array section)</p>
  <p><a href="https://docs.microsoft.com/en-us/azure/data-explorer/ingest-json-formats?tabs=kusto-query-language&amp;source=docs#ingest-json-records-containing-arrays" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/data-explorer/ingest-json-formats?tabs=kusto-query-language&amp;source=docs#ingest-json-records-containing-arrays</a></p>
  <p>My JSON data is different to the example, as it has an additional layer in the JSON, when expanding the raw event row to the second table, the row entered is blank. I assume the function can't find 'Objects' using the kusto function?</p>
  <pre><code>.create function EventRecordsExpand() {
      rawhsievents
      | mv-expand Objects = Event
      | project
          AlarmState = tostring(Objects[&quot;AlarmState&quot;]),
          AreaOfInterest = tostring(Objects[&quot;AreaOfInterest&quot;]),
          Category = tostring(Objects[&quot;Category&quot;]),
          EncodedMessage = tostring(Objects[&quot;EncodedMessage&quot;]),
          Fullname = tostring(Objects[&quot;Fullname&quot;]),
          Id = tolong(Objects[&quot;Id&quot;]),
          Message = tostring(Objects[&quot;Message&quot;]),
          ReceiptTime = todatetime(Objects[&quot;ReceiptTime&quot;]),
          RecordTime = todatetime(Objects[&quot;RecordTime&quot;]),
          Severity = tostring(Objects[&quot;Severity&quot;]),
          User = tostring(Objects[&quot;User&quot;])
  }
  </code></pre>
  <p>An example of my JSON data is below:</p>
  <pre><code>{
      &quot;ExportedEvents&quot;: {
          &quot;Header&quot;: {
              &quot;SystemName&quot;: &quot;Mids&quot;,
              &quot;StartDate&quot;: &quot;2020-11-03T12:28:00.55Z&quot;,
              &quot;EndDate&quot;: &quot;2020-11-03T12:28:11.521Z&quot;
          },
          &quot;Objects&quot;: [{
                  &quot;AlarmState&quot;: &quot;&quot;,
                  &quot;AreaOfInterest&quot;: &quot;&quot;,
                  &quot;Category&quot;: &quot;Action&quot;,
                  &quot;EncodedMessage&quot;: &quot;Kernel,469,M(Lib,101,S\&quot;RequestExportXML\&quot;)&quot;,
                  &quot;Fullname&quot;: &quot;System Resources.XML Interface.Support Processes.Batch Scheduler.Batch Schedule Scanner&quot;,
                  &quot;Id&quot;: 456020,
                  &quot;Message&quot;: &quot;RequestExportXML request rejected - Invalid configuration&quot;,
                  &quot;ReceiptTime&quot;: &quot;2020-11-03T12:28:00.55Z&quot;,
                  &quot;RecordTime&quot;: &quot;2020-11-03T12:28:00.55Z&quot;,
                  &quot;Severity&quot;: &quot;Low&quot;,
                  &quot;User&quot;: &quot;Schedule&quot;
              },
              {
                  &quot;AlarmState&quot;: &quot;&quot;,
                  &quot;AreaOfInterest&quot;: &quot;&quot;,
                  &quot;Category&quot;: &quot;Action&quot;,
                  &quot;EncodedMessage&quot;: &quot;Kernel,469,M(Lib,101,S\&quot;RequestExportXML\&quot;)&quot;,
                  &quot;Fullname&quot;: &quot;System Resources.XML Interface.Support Processes.Batch Scheduler.Batch Schedule Scanner&quot;,
                  &quot;Id&quot;: 456020,
                  &quot;Message&quot;: &quot;RequestExportXML request rejected - Invalid configuration&quot;,
                  &quot;ReceiptTime&quot;: &quot;2020-11-03T12:28:00.551Z&quot;,
                  &quot;RecordTime&quot;: &quot;2020-11-03T12:28:00.551Z&quot;,
                  &quot;Severity&quot;: &quot;Low&quot;,
                  &quot;User&quot;: &quot;Schedule&quot;
              }
          ]
      }
  }
  </code></pre>
  <p>Do i need a second mv-expand to expand the data twice?</p>