How to fix 'parse' operator: Failed to resolve scalar expression named 'msg_s' If the issue persists, please open a support ticket. Request id: 117cf54a-1039-4496-b8b1-13730efa136e

Truong Nga 10 Reputation points
2023-07-05T08:54:43.08+00:00

Erroe_log_query

Azure Data Explorer
Azure Data Explorer
An Azure data analytics service for real-time analysis on large volumes of data streaming from sources including applications, websites, and internet of things devices.
531 questions
{count} votes

4 answers

Sort by: Most helpful
  1. KranthiPakala-MSFT 46,512 Reputation points Microsoft Employee
    2023-07-06T04:31:27.8366667+00:00

    @Truong Nga Welcome to Microsoft Q&A forum and thanks for reaching out here.

    By looking at the error message, looks like the issue is raised at the first parse expression for the column msg_s.
    Could you please confirm if that column/field exists in the table/data, you are looking for?

    While doing my research, from this sample data provided in this documentation, I noticed that the field/column name is msg rather than msg_s.

    Ref documentation: Azure Firewall logs and metrics.

    Here is the sample Application Rule log data available in the Diagnostic logs for Azure Firewall:

    {
      "category": "AzureFirewallApplicationRule",
      "time": "2018-04-16T23:45:04.8295030Z",
      "resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/{resourceName}",
      "operationName": "AzureFirewallApplicationRuleLog",
      "properties": {
          "msg": "HTTPS request from 10.1.0.5:55640 to mydestination.com:443. Action: Allow. Rule Collection: collection1000. Rule: rule1002"
      }
    }
    

    Hence, I recommend replacing msg_s with msg in your query and see if that helps to resolve the issue. If that didn't work, I request you to please share a sample Application rule log that you are querying (Please mask/remove any sensitive information) along with your sample query text instead if the above image, so that we can assist accordingly.

    Hope this information helps. Let us know how it goes.

    Thank you


    Please don’t forget to Accept Answer and Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members.


  2. k govindu 0 Reputation points
    2023-12-13T06:35:30.8766667+00:00

    Still, I am getting an error

    'parse' operator: Failed to resolve scalar expression named 'msg_s'

    0 comments No comments

  3. Boris Shkarupelov 0 Reputation points
    2024-01-31T13:57:15.2266667+00:00

    Here the same - still have this error on logs

    0 comments No comments

  4. Maciej Rybak 40 Reputation points
    2024-04-15T09:46:56.27+00:00

    Hi Guys , any update for this case ? I have same error

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.