Kusto scan算子m_id取值疑问及节点状态会话划分实现咨询

问题背景 #

目标是使用scan算子分析Azure车队遥测数据的状态转换，划分状态会话，规则为：每个会话是节点从“Ready”状态起始，到“HumanInvestigate”状态结束的完整状态序列。
执行如下查询时，输出的m_id取值不符合预期：

datatable(Ts: timespan, nodeState:string)[
    0m, "Ready",
    1m, "Raw",
    2m, "Ready",
    3m, "HumanInvestigate",
    4m, "Ready",
    5m, "Raw",
    6m, "HumanInvestigate", 
    7m, "Ready",
    8m, "Raw",
    9m, "HumanInvestigate"
]
| sort by Ts asc
| scan with_match_id=m_id with (
        step s1: nodeState == "Ready";
        step s2: nodeState != "Ready" and nodeState != "HumanInvestigate";
        step s3: nodeState == "HumanInvestigate";
)

• 实际输出效果：
• 期望输出效果：

根因分析 #

原查询存在两个逻辑缺陷：

1. 未指定scan匹配模式为严格顺序匹配，默认模式下允许重叠匹配，扫描过程中遇到新的Ready状态会直接开启新的匹配序列，不会将其归入当前未结束的会话。
2. 中间步骤s2未配置重复匹配规则，仅能匹配1条中间状态记录，遇到非Raw、非HumanInvestigate的状态（比如序列中重复出现的Ready）会直接中断当前匹配流程。

修正查询 #

添加kind=sequence参数启用严格顺序无重叠匹配，同时给中间步骤添加*修饰符，允许匹配0到多条未到终止状态的记录，直到遇到HumanInvestigate才结束当前会话：

datatable(Ts: timespan, nodeState:string)[
    0m, "Ready",
    1m, "Raw",
    2m, "Ready",
    3m, "HumanInvestigate",
    4m, "Ready",
    5m, "Raw",
    6m, "HumanInvestigate", 
    7m, "Ready",
    8m, "Raw",
    9m, "HumanInvestigate"
]
| sort by Ts asc
| scan with_match_id=m_id kind=sequence with (
        step s1: nodeState == "Ready";
        step s2: nodeState != "HumanInvestigate" *;
        step s3: nodeState == "HumanInvestigate";
)

修正后生成的m_id会严格按「Ready起始 -> 任意中间状态 -> HumanInvestigate结束」的规则分组，即使会话中间重复出现Ready状态，也不会拆分会话，完全匹配预期输出效果。

内容的提问来源于stack exchange，提问作者Vijay KVS