How to parse quoted strings with escaped quotes?

[justinmchase]

I have a log entry such as:

E "foo \"bar\" baz" {}

And I'm parsing like so:

| parse LogEntry with Level "\"" Message "\"" Data

But of course the message is parsing as foo \ but I want it to be foo \"bar\" baz. How can I parse a quote segment like that with escaped quotes in it?

[sloutsky]

General remark: It's better to ask these kind of questions on StackOverflow, tagging questions with 'KQL' (the question is generic how-to, and not related to parser functionality).

Anyway, to answer it: you can get more granular control over parsing with help of exctact_all() function:

print LogEntry='E "foo \"bar\" baz" {}' | extend p = extract_all(@'(?P.+?)\"(?P.+\")(?P.*)', LogEntry) | extend Level = tostring(p[0][0]), Message=tostring(p[0][1]), Data=tostring(p[0][2]) | project-away p