format the results in kusto - json

Question

example
in the following example we need to summerize the user logs.
datatable(user:string, dt:datetime,page: string, value:int)
[
'chmod', datetime(2019-07-15), "page1", 1,
'ls', datetime(2019-07-02), "page2", 2,
'dir', datetime(2019-07-22), "page3", 3,
'mkdir', datetime(2019-07-14), "page4", 4,
'rm', datetime(2019-07-27), "page5", 5,
'pwd', datetime(2019-07-25), "page6", 6,
'rm', datetime(2019-07-23), "page7", 7,
'pwd', datetime(2019-07-25), "page8", 8,
]
| summarize commands_details = make_list(pack('dt', dt, 'page', page, "value", value)) by user
results
the results in the last example query will be like
"user": pwd,
"commands_details": [
{
"dt": "2019-07-25T00:00:00.0000000Z",
"page": "page6",
"value": 6
},
{
"dt": "2019-07-25T00:00:00.0000000Z",
"page": "page8",
"value": 8
}
],
expected results
but i need the results to be like the following
"user": pwd,
"commands_details": [
{
"dt": "2019-07-25T00:00:00.0000000Z",
"data":[
{"page": "page6", "value": 6},
{"page": "page8", "value": 8}
]
}
],
question
is there any way in Kusto to formate the results like the expected section?

Answer 1

You can use next query to achieve this:
datatable(user:string, dt:datetime,page: string, value:int)
[
'chmod', datetime(2019-07-15), "page1", 1,
'ls', datetime(2019-07-02), "page2", 2,
'dir', datetime(2019-07-22), "page3", 3,
'mkdir', datetime(2019-07-14), "page4", 4,
'rm', datetime(2019-07-27), "page5", 5,
'pwd', datetime(2019-07-25), "page6", 6,
'rm', datetime(2019-07-23), "page7", 7,
'pwd', datetime(2019-07-25), "page8", 8,
]
| summarize commands_details = make_list(pack('page', page, "value", value)) by user, dt
| project result = pack('user', user, 'data', pack('dt', dt, 'data', commands_details))
A result (for 'pwd'):
{
"user": "pwd",
"data": {
"dt": "2019-07-25T00:00:00Z",
"data": [
{
"page": "page6",
"value": 6
},
{
"page": "page8",
"value": 8
}
]
}
}