使用Runbook解析含静态URL的KQL extend语句时出现解析错误

错误原因 #

BadArgumentError- Query could not be parsed at 'https' 是因为extend语句里的HTML链接中，href属性的双引号未正确转义，与外层字符串的双引号冲突，导致KQL解析器无法正确识别URL起始的https。此外，原语句最后一个参数存在多余双引号，也会干扰解析。

解决方案 #

方法1：转义嵌套双引号 #

在KQL字符串中，嵌套的双引号需要用两个连续双引号转义，同时修正多余的双引号：

| extend Body = strcat(@"<p>The following items are expiring <strong>within 30 days</strong></p>", 
                       "<p>Plan to remediate as soon as possible.</p>", 
                       "<p>If the item is no longer valid, please remove it from ", 
                       "<a href=""https://portal.azure.com/#@fabrikam.com/resource/subscriptions/0000-0000-000/resourceGroups/000resourcegroup/providers/microsoft.insights/components/Fabrikam_Monitoring/availability"">Application Insights</a></p>", 
                       "<p>Property: ", Name, "</p>", 
                       "<p>Expires In: ", ExpiresIn, " day(s) </p>")

方法2：改用单引号包裹外层字符串 #

如果外层字符串改用单引号，内部HTML的双引号无需转义，同样能避免解析冲突：

| extend Body = strcat(@'<p>The following items are expiring <strong>within 30 days</strong></p>', 
                       '<p>Plan to remediate as soon as possible.</p>', 
                       '<p>If the item is no longer valid, please remove it from ', 
                       '<a href="https://portal.azure.com/#@fabrikam.com/resource/subscriptions/0000-0000-000/resourceGroups/000resourcegroup/providers/microsoft.insights/components/Fabrikam_Monitoring/availability">Application Insights</a></p>', 
                       '<p>Property: ', Name, '</p>', 
                       '<p>Expires In: ', ExpiresIn, ' day(s) </p>')

内容的提问来源于stack exchange，提问作者floopsandRoot