Kusto query to extract useful fields from Azure Firewall logs

azure_firewall.kusto

AzureDiagnostics
| where ResourceType == "AZUREFIREWALLS"
| extend
     proto =      extract(@"^([A-Z]+) ",1,msg_s)
    ,src_host =   extract(@"request from ([\d\.]*)",1,msg_s)
    ,src_port =   extract(@"request from [\d\.]*:(\d+)",1,msg_s)
    ,dest_host =  extract(@" to ([-\w\.]+)(:|\. |\.$)",1,msg_s)
    ,dest_port =  extract(@" to [-\w\.]+:(\d+)",1,msg_s)
    ,action =     iif(
       msg_s has "was denied"
      ,"Deny"
      ,extract(@" Action: (\w+)",1,msg_s))
    ,rule_coll =  extract(@" Rule Collection: (\w+)",1,msg_s)
    ,rule =       coalesce(
       extract(@" Rule: (.*)",1,msg_s)
      ,extract("No rule matched",0,msg_s))
    ,reason =     extract(@" Reason: (.*)",1,msg_s)
| project TimeGenerated,Category,proto,src_host,src_port,dest_host,dest_port,action,rule_coll,rule,reason,msg_s

Sorry i'm new to KQL, I am working with AZFWs, can I please ask what this particular query does ..?

We are no longer using Azure FW in our environment. We looked at when it was first released. At the time, the schema it wrote into log analytics did not have many useful fields. This query parsed the msg_s column to get the fields I wanted. I expect the schema has changed since then.

Thanks, Just to confirm this still works.