CODEWITHSUNDEEP
jq
Andreas Guther
Andreas Guther

Reputation: 432

Get matching objects sub array

I have an elasticsearch aggregation response and want to use jq to filter a matching objects sub array do to further extraction (at the end create a csv file)

I have a response like the following one:

{
  "took": 189,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 614388,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "sites_monthly_top_10": {
      "doc_count_error_upper_bound": 4507,
      "sum_other_doc_count": 205762,
      "buckets": [
        {
          "key": "this.com",
          "doc_count": 120903,
          "monthly": {
            "buckets": [
              {
                "key_as_string": "2021-03 March",
                "key": 1614556800000,
                "doc_count": 16733
              },
              {
                "key_as_string": "2021-04 April",
                "key": 1617235200000,
                "doc_count": 12744
              }
            ]
          }
        },
        {
          "key": "that.com",
          "doc_count": 81451,
          "monthly": {
            "buckets": [
              {
                "key_as_string": "2021-03 March",
                "key": 1614556800000,
                "doc_count": 4641
              },
              {
                "key_as_string": "2021-04 April",
                "key": 1617235200000,
                "doc_count": 8687
              }
            ]
          }
        }
      ]
    }
  }
}

I want to work on the bucket element that has the key "this.com". Matching works, but I still get both sub elements.

cat response.json | jq -r ' .aggregations.sites_monthly_top_10.buckets | select( .[].key | contains("this.com")) | .[].monthly.buckets'

gives me

[
  {
    "key_as_string": "2021-03 March",
    "key": 1614556800000,
    "doc_count": 16733
  },
  {
    "key_as_string": "2021-04 April",
    "key": 1617235200000,
    "doc_count": 12744
  }
]
[
  {
    "key_as_string": "2021-03 March",
    "key": 1614556800000,
    "doc_count": 4641
  },
  {
    "key_as_string": "2021-04 April",
    "key": 1617235200000,
    "doc_count": 8687
  }
]

but I would like to access only monthly.buckets of the matching one.

What am I missing here?

Upvotes: 0

Views: 1069

Answers (1)

pmf
pmf

Reputation: 36151

Pull out the iteration [] in front of select to apply the filter to each array item and keep its context. Also, to perform a partial match, contains is fine, for the the exact match you may use ==.

jq '.aggregations.sites_monthly_top_10.buckets[] | select(.key == "this.com").monthly.buckets' response.json

[
  {
    "key_as_string": "2021-03 March",
    "key": 1614556800000,
    "doc_count": 16733
  },
  {
    "key_as_string": "2021-04 April",
    "key": 1617235200000,
    "doc_count": 12744
  }
]

Demo

Upvotes: 1

Related Questions