Reputation: 49
This works to search for tactics that equal "impact". However, it will only pull the objects themselves.
jq '.techniques[] | select(.tactic == "impact")'
Is there no way to use select while walking through json with something like jq '. | select(.techniques[].tactic == "impact")'
? I'm guessing the issue is that something like that, even if it works, still does not explicitly say to leave the previous items as well.
It is not viable to manually rebuild the parent.
input
{
"viewMode": 0,
"hideDisabled": false,
"techniques": [
{
"name": "john",
"tactic": "reconnaissance"
},
{
"name": "jane",
"tactic": "impact"
},
{
"name": "jill",
"tactic": "execution"
}
],
"karma": "yes"
}
desired output
{
"viewMode": 0,
"hideDisabled": false,
"techniques": [
{
"name": "jane",
"tactic": "impact"
}
],
"karma": "yes"
}
If this is so remedial that it warrants no response, I'll figure it out and update. It seems like the most basic thing. I'll also be doing a !=, which also works fine normally, but doesn't capture the entire body.
I have tried using variables to do it, which get me close;
jq '{techniques: [.techniques[] | select(.tactic == "impact")]} as $a| $a' test.json
However, trying to add a key "techniques" to that array ruins my ability to use it;
jq '{techniques: [.techniques[] | select(.tactic == "impact")]} as $a| $a + [.]' test.json
jq: error (at test.json:19): object ({"technique...) and array ([{"viewMode...) cannot be added
Upvotes: 3
Views: 847
Reputation: 116949
|=
is your friend, e.g.
.techniques |= map(select(.tactic == "impact"))
Upvotes: 5