CODEWITHSUNDEEP
jsonsyntaxnestedkeyjq
Adam
Adam

Reputation: 5445

Can I output a property with jq based on a nested property in the input?

This follows on from Extracting selected properties from a nested JSON object with jq which lets the OP there get rid of a load of unwanted properties from a nested object.

I've got the same problem but instead of an array starting [, just have a stream of JSON objects, each like this:

{
   "localHostName" : "rest-2-17ve6",
   "port" : "80",
   "requestHeaders" : {
      "x-forwarded-port" : "443",
      "x-forwarded-host" : "dummy.com",
      "content-length" : "15959431",
      "accept" : "*/*",
      "x-forwarded-for" : "10.1.9.11",
      "authorization" : "hash is present",
      "expect" : "100-continue",
      "forwarded" : "for=10.5.9.1;host=dummy.com;proto=https",
      "content-type" : "application/json",
      "host" : "dummy.com",
      "x-forwarded-proto" : "https",
      "user-agent" : "curl/7.51.0"
   },
   "uri" : "/2/data/saveList",
   "protocol" : "HTTP/1.1",
   "threadName" : "http-nio-8080-exec-10",
   "requestBytes" : 15959431,
   "applicationDuration" : 44135,
   "responseStatus" : "200",
   "remoteIpAddress" : "10.1.10.1",
   "responseHeaders" : {
      "X-XSS-Protection" : "1; mode=block",
      "Content-Type" : "application/json;charset=UTF-8",
      "X-Content-Type-Options" : "nosniff",
      "Cache-Control" : "no-cache, no-store, max-age=0, must-revalidate",
      "Date" : "Wed, 20 Jun 2018 15:53:27 GMT",
      "Transfer-Encoding" : "chunked",
      "Vary" : "Accept-Encoding",
      "X-Frame-Options" : "DENY",
      "Expires" : "0",
      "Pragma" : "no-cache"
   },
   "isoDateTime" : "2018-06-20T15:52:42.466913985Z",
   "method" : "POST",
   "username" : "rd7y1",
   "localIpAddress" : "10.129.9.238",
   "responseBytes" : 2,
   "requestContentExcerpt" : "blah",
   "totalDuration" : 44869,
   "responseContentExcerpt" : " [] "
}

I want to filter the stream on the command line so I only get:

{ 
   "isoDateTime" : "2018-06-20T15:52:42.466913985Z",
   "method" : "POST",
   "username" : "rd7y1",
   "requestHeaders.user-agent" : "Rcurl"
}

I tried cat /logs/json.log | jq -cC 'map(requestHeaders|={user-agent})' but I'm getting a syntax error.

Upvotes: 0

Views: 502

Answers (1)

peak
peak

Reputation: 116660

  1. Since jq is stream-oriented, you would just use select(...) rather than map(select(...))

  2. It looks like you intend to use .requestHeaders."user-agent" in the criterion for selection.

  3. It's generally recommended to avoid using cat when possible.

  4. According to your stated requirements, you should drop the -c command-line option.

  5. Since "Rcurl" does not appear in your sample input, I'll use the string that does appear.

So in your case, you'd end up with something like:

< /logs/json.log jq '
  select(.requestHeaders."user-agent" == "curl/7.51.0")
  | {isoDateTime, method, username,
     "requestHeaders.user-agent": .requestHeaders."user-agent"}'

Upvotes: 4

Related Questions