Azure逻辑应用For_each执行失败求助：Null非有效数组

错误信息 #

ExpressionEvaluationFailed. The execution of template action 'For_each' failed: the result of the evaluation of 'foreach' expression '@triggerBody()?['incidentUpdates']' is of type 'Null'. The result must be a valid array.

场景说明 #

我正在实现一个定期剧本，每周一至周五下班时间触发，收集分配给分析师的所有事件的ID、名称、描述、URL信息，生成HTML表格后发送给同事。测试时遇到上述错误。

流第一个动作的JSON输出 #

"headers": {
    "Connection": "Close",
    "Accept": "*/*",
    "Accept-Encoding": "gzip,deflate",
    "Accept-Language": "en",
    "Host": "management.southafricanorth.logic.azure.com",
    "Referer": "https://management.azure.com/subscriptions/17eeca6a-0dea-41e9-8fc9-f12b59cfad62/resourcegroups/ACSA_CSOC_RG/providers/Microsoft.Logic/workflows/All-incidents-in-a-given-time-frame/triggers/Microsoft_Sentinel_incident/run?api-version=2016-10-01",
    "User-Agent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/113.0.0.0,Safari/537.36,Edg/113.0.1774.50",
    "x-ms-client-session-id": "6cfb9cdfea3248d3a41dba1f89e410ad",
    "x-ms-command-name": "Microsoft_Azure_EMA.",
    "x-ms-effective-locale": "en.en-us",
    "x-ms-client-request-id": "52e3f450-f914-46f0-9370-03e70fcda011",
    "sec-fetch-site": "same-site",
    "sec-fetch-mode": "cors",
    "sec-fetch-dest": "empty",
    "x-ms-arm-resource-system-data": "{\"lastModifiedBy\":\"lumka@phakamo.co.za\",\"lastModifiedByType\":\"User\",\"lastModifiedAt\":\"2023-05-26T11:12:11.5409557Z\"}",
    "x-ms-arm-request-tracking-id": "d4901af4-623e-4c2e-bd1a-78a0ea3be9d7",
    "x-ms-correlation-request-id": "d4901af4-623e-4c2e-bd1a-78a0ea3be9d7",
    "x-ms-routing-request-id": "SOUTHAFRICANORTH:20230526T111211Z:d4901af4-623e-4c2e-bd1a-78a0ea3be9d7",
    "x-ms-client-location": "southafricanorth",
    "x-ms-home-tenant-id": "fb62d46e-e86e-4673-ba82-b27b61d8202b",
    "x-ms-client-ip-address": "41.150.225.141",
    "x-ms-arm-service-request-id": "8ba39e8f-b89a-4d1c-ba60-0f23ebb8f715",
    "x-ms-management-group-ancestors": "fb62d46e-e86e-4673-ba82-b27b61d8202b",
    "x-ms-client-audience": "https://management.core.windows.net/",
    "x-ms-client-scope": "user_impersonation",
    "x-ms-client-acr": "1",
    "x-ms-client-app-id": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
    "x-ms-client-app-id-acr": "2",
    "x-ms-client-tenant-id": "506a7cb6-60b5-4cc7-8dfc-28daca27e296",
    "x-ms-client-issuer": "https://sts.windows.net/506a7cb6-60b5-4cc7-8dfc-28daca27e296/",
    "x-ms-client-object-id": "807dd4d9-6007-4cac-a771-07cf40630ad8",
    "x-ms-client-puid": "100320012670DEE5",
    "x-ms-client-alt-sec-id": "",
    "x-ms-client-principal-id": "100320012670DEE5",
    "x-ms-client-authorization-source": "RoleBased",
    "x-ms-client-identity-provider": "",
    "x-ms-client-authentication-methods": "pwd, rsa, mfa",
    "x-ms-client-principal-group-membership-source": "Token",
    "x-ms-client-principal-name": "lumka@phakamo.co.za",
    "x-ms-client-family-name-encoded": "TGFuZ2E=",
    "x-ms-client-given-name-encoded": "THVta2E=",
    "x-ms-arm-network-source": "PublicNetwork",
    "traceparent": "00-b75aaa8c8d8f63a0ea3110c0d52770a4-cae5b018000a229b-01",
    "x-ms-activity-vector": "IN.09",
    "Content-Length": "0",
    "Content-Type": "application/json"
}

问题分析与修复方案 #

核心问题 #

你使用的@triggerBody()?['incidentUpdates']表达式指向的字段不存在或为Null，且流的基础逻辑错误：

• 需求是定期触发拉取所有事件，但当前用的是Microsoft Sentinel incident触发器（该触发器仅在事件更新时触发，而非定期拉取全量事件），所以触发Body中没有incidentUpdates字段，导致循环表达式返回Null。

修复步骤 #

• 替换触发器：将当前触发器换成Recurrence（定期）触发器，配置每周一至周五下班时间触发的规则。
• 添加事件获取动作：在触发器后添加Get incidents（Microsoft Sentinel连接器下的动作），设置筛选条件（如分配目标、时间范围等）。
• 修正循环表达式：将For_each的循环目标改为@body('Get_incidents')?['value']，这是Get incidents返回的事件数组。
• 兼容空数组场景：为避免无事件时报错，可使用表达式@coalesce(body('Get_incidents')?['value'], createArray())，确保无事件时返回空数组而非Null。

内容的提问来源于stack exchange，提问作者Gift