How to use Regex in kusto query - azure-log-analytics

Question

So I have a Kusto query like this
exceptions
| extend A_= tostring(customDimensions.A)
| where A_ in~ ("Could not get notes: From:", "failed to call", "Custom conference list" )
// | where A_ contains 'Could not get notes: From:' //This is working when I use "contains" operator but fails to check below 2 items when the first item doesn't exist
// | where A_ contains 'Custom conference list'
// | where A_ contains 'failed to call'
The first item in the list is "Could not get notes: From:", where it has multiple ID at the end of the string
For example;
Could not get notes: From: abcd
Could not get notes: From: abcdef
What I am trying to do is take all the items that start with "Could not get notes: From:" and use them in the "in~" operator.
So far I have tried using contains operator like below
|where A_ contains 'Could not get notes: From:' // This seems to be working as it will outputting every item that starts with "Could not get notes: From:" but when I am trying to use it in the "in~" it is failing.
The problem with using the "contains" operator for each unique item is if any of the items(let's say for 3 items) will not there, the query returns no results even if 2 items still exist.
Not sure if this has a better solution to it.

Answer 1

You should use has_any instead:
exceptions
| extend A_= tostring(customDimensions.A)
| where A_ has_any ("Could not get notes: From:", "failed to call", "Custom conference list")
Also, note that contains is significantly slower than has/has_any, because the latter uses the index to only fetch relevant records, while contains scans all the records. Note, however, that there's a semantic difference between the two: contains looks for substrings, while has only looks for full tokens. For example, "hello world" contains "hell" will return true, while "hello world" has "hell" will return false. See more info in the String Operators doc.