Kusto/Data Explorer如何筛选列名包含date的所有列

• 第一个问题：你定义的ColswithDates是存储列元数据的表结构，而project运算符需要传入明确的列名/列名集合，无法直接识别表类型的变量作为参数，执行时会直接报「列 ColswithDates 不存在」的错误。
• 第二个问题：没有将筛选得到的日期列名转换为project/project_columns支持的动态数组格式，无法实现批量选择列的效果。

以下代码可直接运行实现仅返回所有带date标识的列：

let T1 = datatable (col1:string, col2:string, Date1:string, Date2:string)[
"abc", "def", "2021-11-3", "2021-11-4",
"ghi", "jkl", "2021-11-5", "2021-11-6",
"mno", "pqr", "2021-11-7", "2021-11-8",
"stu", "v", "2021-11-9", "2021-11-10",
"wx", "yz", "2021-11-11", "2021-11-12"];
// 筛选所有列名含date的列，汇总为动态数组，toscalar用于将单行单列的表结果转为标量变量
let ColswithDates = toscalar(
    T1
    | getschema 
    | where ColumnName contains "date"
    | summarize make_list(ColumnName)
);
// project_columns支持传入动态列名数组实现批量选列
T1 
| project_columns(ColswithDates)

如果需要同时把字符串格式的日期列转换为标准datetime类型，可以使用扩展写法：

let T1 = datatable (col1:string, col2:string, Date1:string, Date2:string)[
"abc", "def", "2021-11-3", "2021-11-4",
"ghi", "jkl", "2021-11-5", "2021-11-6",
"mno", "pqr", "2021-11-7", "2021-11-8",
"stu", "v", "2021-11-9", "2021-11-10",
"wx", "yz", "2021-11-11", "2021-11-12"];
let ColswithDates = toscalar(
    T1
    | getschema 
    | where ColumnName contains "date"
    | summarize make_list(ColumnName)
);
T1 
| project_columns(ColswithDates)
// 批量转换所有日期列为datetime类型
| evaluate bag_unpack(
    bag_pack_columns(ColswithDates)
    | mv_with_types expand key to string, val to string
    | extend p = bag_pack(key, todatetime(val))
    | summarize bag_merge(p)
)

内容的提问来源于stack exchange，提问作者PorgtheEaten