We have our Sitecore instance writing it’s logs into Trace messages in App Insights. There is some filtering, but basically, the message written to the log file is put in the Message field of the Trace entries. So, an entry in the publishing log file would look like:

21192 14:23:07 INFO  ##Publish Item: Name=Home, Uri=sitecore://master/{110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9}?lang=en&ver=1, Operation=Skipped, ChildAction=Allow, Explanation=The source and target items have the same revision number.

And in App Insights, it looks like:

The problem was, I wanted to summarize details about these publishes, but the details are all part of one big string. Specifically, I wanted to see the count of the operation, and the reason for that operation. I was expecting to have to do some big regex to figure it out.

Boy, was I wrong. I give you the Kusto Parse() function.

traces 
| where message startswith "##Publish Item: "
| parse message with "##Publish Item: Name=" scName ", Uri=sitecore://master/" scID "?lang=en&ver=" scVersion ", Operation=" scPubOperation ", ChildAction=" scChildAction ", Explanation=" scPubReason
| summarize count() by scPubOperation, scPubReason

The parse function extracts the bits of the string I want into variables, and I can then use them to generate my summary.