I need some help with formatting json data. I'm converting a table to json to be ingested into a log collector. The collector only likes json in single line format. How can I convert this json:
[
{ "Severity": "Informational",
"Type": "Milestone",
"SiteCode": "ABC",
"DateTime": 1505840220813,
"System": "Server.domain.local",
"Component": "SMS_Distribution_Point_Monitoring",
"Module": "SMS Server",
"MessageID": 2380,
"Description": "Start to evaluate package ABC001F5 on distribution point Display=\\\\Server.domain.local\\ MSWNET: SMS_SITE=ABC \\\\Server.domain.local\\."
},
{ "Severity": "Informational",
"Type": "Milestone",
"SiteCode": "ABC",
"DateTime": 1505840220787,
"System": "Server.domain.local",
"Component": "SMS_Distribution_Point_Monitoring",
"Module": "SMS Server",
"MessageID": 2384,
"Description": "Package ABC0019F on distribution point Display=\\\\Server.domain.local\\ MSWNET: SMS_SITE=ABC \\\\Server.domain.local\\ has been verified successfully."
}
]
to this in powershell when outputting to a file:
[{"Severity":"Informational","Type":"Milestone","SiteCode":"ABC","DateTime":1505840220813,"System":"Server.thecarlylegroup.local","Component":"SMS_Distribution_Point_Monitoring","Module":"SMSServer","MessageID":2380,"Description":"StarttoevaluatepackageABC001F5ondistributionpointDisplay=\\\\Server.thecarlylegroup.local\\MSWNET:SMS_SITE=ABC\\\\Server.thecarlylegroup.local\\."},
{"Severity":"Informational","Type":"Milestone","SiteCode":"ABC","DateTime":1505840220787,"System":"Server.thecarlylegroup.local","Component":"SMS_Distribution_Point_Monitoring","Module":"SMSServer","MessageID":2384,"Description":"PackageABC0019FondistributionpointDisplay=\\\\Server.thecarlylegroup.local\\MSWNET:SMS_SITE=ABC\\\\Server.thecarlylegroup.local\\hasbeenverifiedsuccessfully."}]
Assuming you get your data out of your table and into a string similar to the following:
$json = #"
[
{ "Severity": "Informational",
"Type": "Milestone",
"SiteCode": "ABC",
"DateTime": 1505840220813,
"System": "Server.domain.local",
"Component": "SMS_Distribution_Point_Monitoring",
"Module": "SMS Server",
"MessageID": 2380,
"Description": "Start to evaluate package ABC001F5 on distribution point Display=\\\\Server.domain.local\\ MSWNET: SMS_SITE=ABC \\\\Server.domain.local\\."
},
{ "Severity": "Informational",
"Type": "Milestone",
"SiteCode": "ABC",
"DateTime": 1505840220787,
"System": "Server.domain.local",
"Component": "SMS_Distribution_Point_Monitoring",
"Module": "SMS Server",
"MessageID": 2384,
"Description": "Package ABC0019F on distribution point Display=\\\\Server.domain.local\\ MSWNET: SMS_SITE=ABC \\\\Server.domain.local\\ has been verified successfully."
}
]
"#
Then you can do this (the depth was chosen arbitrarily to ensure that the entire object was converted):
$compressedJson = $json | ConvertFrom-Json | ConvertTo-Json -Compress -Depth 100
If you're working a string:
$var = (#"
[
{ "Severity": "Informational",
"Type": "Milestone",
"SiteCode": "ABC",
"DateTime": 1505840220813,
"System": "Server.domain.local",
"Component": "SMS_Distribution_Point_Monitoring",
"Module": "SMS Server",
"MessageID": 2380,
"Description": "Start to evaluate package ABC001F5 on distribution point Display=\\\\Server.domain.local\\ MSWNET: SMS_SITE=ABC \\\\Server.domain.local\\."
},
{ "Severity": "Informational",
"Type": "Milestone",
"SiteCode": "ABC",
"DateTime": 1505840220787,
"System": "Server.domain.local",
"Component": "SMS_Distribution_Point_Monitoring",
"Module": "SMS Server",
"MessageID": 2384,
"Description": "Package ABC0019F on distribution point Display=\\\\Server.domain.local\\ MSWNET: SMS_SITE=ABC \\\\Server.domain.local\\ has been verified successfully."
}
]
"# -split "`n" | % { $_.Trim() }) -join ''
Related
How do I remove all elements in the below JSON where 'Name = "Test HD Module 2" and Team = "Help Desk"?'
{
"Content": {
"Modules": [
{
"ID": 2,
"Name": "Test HD Module 2",
"Description": "This module opens the Google website.",
"Team": "Help Desk",
"Is_Admin": "No",
"Location": "Server",
"Client_Facing": "No",
"Action": "Website",
"Image_Name": "teamviewer",
"Image_Path": "C:Temp/Userss",
"Is_Popup": false,
"Popup_Text": "",
"Submodule": "false",
"Is_Editable": "true"
},
{
"ID": 3,
"Name": "Test HD Module 2",
"Team": "Server",
"Description": "This module opens the website.",
"Is_Admin": "No",
"Location": "Server",
"Client_Facing": "No",
"Action": "Website",
"Image_Name": "device-info",
"Image_Path": "C:Temp/Userss",
"Is_Popup": true,
"Popup_Text": "Are you sure you want to run Test HD Module 3?",
"Submodule": "false",
"Is_Editable": "false"
}
],
"Sub-Modules": [
{
"ID": 4,
"Name": "Test HD Sub-Module 3",
"Team": "Help Desk",
"Is_Admin": "No",
"Location": "Server",
"Client_Facing": "No",
"Action": "CMD",
"Action_Text": "",
"Image_Name": "device-info",
"Image_Path": "C:Temp/Users",
"Is_Popup": "false",
"Popup_Text": "",
"Submodule": "true",
"Is_Editable": "false"
}
]
}
}
I've tried using below but have had no luck.
$JSON | Where-Object {$_.Modules.Name -ne "Test HD Module 2" -and $_.Modules.Team -ne "Help Desk" }
Is there an easier way to filter a JSON? I basically want the same JSON but with those elements removed (I need to keep the 'Sub-Modules' information). Is the Where-Object the correct route when filtering a JSON?
I believe the expression you're looking for is:
-not ($_.Name -eq "Test HD Module 2" -and $_.Team -eq "Help Desk")
Different from the expression you currently have, which would for example, exclude any object where Name != Test HD Module 2.
If you want to update your object you can use the following:
$json = Get-Content path\to\myjson.json -Raw | ConvertFrom-Json
$json.Content.Modules = #(
$json.Content.Modules | Where-Object {
-not ($_.Name -eq "Test HD Module 2" -and $_.Team -eq "Help Desk")
}
)
$json | ConvertTo-Json -Depth 99 | Set-Content path\to\mynewjson.json
The array subexpression operator #(...) ensures that the Modules property will become an array.
Resulting Json using the example in question would become:
{
"Content": {
"Modules": [
{
"ID": 3,
"Name": "Test HD Module 2",
"Team": "Server",
"Description": "This module opens the website.",
"Is_Admin": "No",
"Location": "Server",
"Client_Facing": "No",
"Action": "Website",
"Image_Name": "device-info",
"Image_Path": "C:Temp/Userss",
"Is_Popup": true,
"Popup_Text": "Are you sure you want to run Test HD Module 3?",
"Submodule": "false",
"Is_Editable": "false"
}
],
"Sub-Modules": [
{
"ID": 4,
"Name": "Test HD Sub-Module 3",
"Team": "Help Desk",
"Is_Admin": "No",
"Location": "Server",
"Client_Facing": "No",
"Action": "CMD",
"Action_Text": "",
"Image_Name": "device-info",
"Image_Path": "C:Temp/Users",
"Is_Popup": "false",
"Popup_Text": "",
"Submodule": "true",
"Is_Editable": "false"
}
]
}
}
We are migrating from Chrome to Edge Chromium (and when Microsoft puts the final nail into the IE 11 coffin from IE 11 as well). This is being done when PCs are being replaced.
We are using USMT to copy users files over. So the old computer may or may not have Chrome, but if it does, I'd like to copy the bookmark files. If it has Edge installed too (most do), I'd like to copy those bookmarks too. When restoring the USMT data, I'd like to add a step to our restore script that merges the results of both of the bookmark files into one JSON file and import it into Edge Chromium (I think I can just plop the "Bookmarks" file into "C:\Users$UserID\AppData\Local\Microsoft\Edge\User Data\Default").
I have these three functions that get called in other parts of the script:
Function Backup-ChromeBookmarks {
$pathToChromeJsonFile = -join("C:\Users\", $UserID, "\AppData\local\Google\Chrome\User Data\Default\Bookmarks")
$global:chromeBookmarkExists = Test-Path $pathToChromeJsonFile
if ($chromeBookmarkExists -eq $true){
Copy-Item -Path $pathToChromeJsonFile -Destination $BackupStore/Bookmarks-chrome.json
}
}
Function Backup-EdgeBookmarks {
$pathToEdgeJsonFile = -join("C:\Users\", $UserID, "\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks")
$global:edgeBookmarkExists = Test-Path $pathToEdgeJsonFile
if ($edgeBookmarkExists -eq $true){
Copy-Item -Path $pathToEdgeJsonFile -Destination $BackupStore/Bookmarks-edge.json
}
}
Function Combine-Bookmarks {
# referenced https://www.jonathanmedd.net/2020/04/combine-two-json-files-with-powershell.html
#https://web.archive.org/web/20200517182000/https://www.jonathanmedd.net/2020/04/combine-two-json-files-with-powershell.html
if($chromeBookmarkExists -eq $true -And $edgeBookmarkExists -eq $true){
$data1 = Get-Content $BackupStore/Bookmarks-chrome.json -Raw | ConvertFrom-Json
$data2 = Get-Content $BackupStore/Bookmarks-edge.json -Raw | ConvertFrom-Json
$data1.psobject.Properties | ForEach-Object {
$data2 | Add-Member -MemberType $_.MemberType -Name $_.Name -Value $_.Value -Force
}
#($data2) | ConvertTo-Json | Out-File $BackupStore/Bookmarks
}
}
It works to copy the "Bookmarks" files from Chrome and Edge, but when it combines them and writes the file, this is all the contents are:
"checksum": "0f9bf8e97b9ac6cd3654c15c673b8cb8",
"roots": {
"bookmark_bar": {
"children": " ",
"date_added": "13252082948039886",
"date_modified": "13268156238031255",
"guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",
"id": "1",
"name": "Bookmarks bar",
"type": "folder"
},
"other": {
"children": "",
"date_added": "13252082948040297",
"date_modified": "0",
"guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",
"id": "2",
"name": "Other bookmarks",
"type": "folder"
},
"synced": {
"children": "",
"date_added": "13252082948040301",
"date_modified": "0",
"guid": "4cf2e351-0e85-532b-bb37-df045d8f8d0f",
"id": "3",
"name": "Mobile bookmarks",
"type": "folder"
}
},
"version": 1
}
Does anyone have any idea what I am doing wrong with merging the two JSON files? I don't have a lot of experience with this and would appreciate any feedback.
Please let me know if I'm missing any info. Thanks!
Here are some random bookmark lists from Chrome and Edge for sample data:
Chrome
"checksum": "0e3450f30154cec188275de0e1eed2a5",
"roots": {
"bookmark_bar": {
"children": [ {
"date_added": "13282342589274138",
"guid": "dff3def7-9693-443c-a44c-2b1047687b33",
"id": "5",
"name": "Google News",
"type": "url",
"url": "https://news.google.com/topstories?hl=en-CA&gl=CA&ceid=CA:en"
}, {
"children": [ {
"date_added": "13282342602339055",
"guid": "3a6114ed-d13a-491e-a049-d47a174a349b",
"id": "7",
"name": "reddit - Google Search",
"type": "url",
"url": "https://www.google.com/search?q=reddit&oq=reddit&aqs=chrome..69i57j46i131i199i433i465i512j0i131i433i512l3j0i131i433j0i131i433i512l3.1205j0j7&sourceid=chrome&ie=UTF-8"
}, {
"date_added": "13282342613505854",
"guid": "0da478c1-a91b-4af9-80db-cae8dc6927c0",
"id": "8",
"name": "Reddit - Dive into anything",
"type": "url",
"url": "https://www.reddit.com/"
}, {
"date_added": "13282342620306591",
"guid": "b0311e2e-a41f-47fa-a1ef-214dd3964729",
"id": "9",
"name": "Facebook - Log In or Sign Up",
"type": "url",
"url": "https://www.facebook.com/"
}, {
"date_added": "13282342631549806",
"guid": "a06637af-50be-458e-95bc-730ffc1cda36",
"id": "10",
"name": "Instagram",
"type": "url",
"url": "https://www.instagram.com/?hl=en"
} ],
"date_added": "13282342597429656",
"date_modified": "13282342644382518",
"guid": "a5b18126-11f7-40df-809f-2d96f311f1f6",
"id": "6",
"name": "Test Folder",
"type": "folder"
}, {
"date_added": "13282342644382518",
"guid": "39ef0ac5-b70c-406e-acea-96c3f90935ef",
"id": "11",
"name": "Dogpile.com",
"type": "url",
"url": "https://www.dogpile.com/"
}, {
"date_added": "13282342655028948",
"guid": "d152f027-2aae-47b1-bae6-f9d7e617b639",
"id": "12",
"name": "Ask.com - What's Your Question?",
"type": "url",
"url": "https://www.ask.com/"
} ],
"date_added": "13282342511050735",
"date_modified": "13282342655028948",
"guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",
"id": "1",
"name": "Bookmarks bar",
"type": "folder"
},
"other": {
"children": [ ],
"date_added": "13282342511050739",
"date_modified": "0",
"guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",
"id": "2",
"name": "Other bookmarks",
"type": "folder"
},
"synced": {
"children": [ ],
"date_added": "13282342511050740",
"date_modified": "0",
"guid": "4cf2e351-0e85-532b-bb37-df045d8f8d0f",
"id": "3",
"name": "Mobile bookmarks",
"type": "folder"
}
},
"version": 1
}
Edge
{
"checksum": "c26640ae81258f8bb73935ccd2bb1e91",
"roots": {
"bookmark_bar": {
"children": [ {
"date_added": "13282342518391441",
"guid": "00f514ec-8d15-45b1-9c26-ba258d59c688",
"id": "9",
"name": "Google News",
"show_icon": false,
"source": "user_add",
"type": "url",
"url": "https://news.google.com/topstories?hl=en-CA&gl=CA&ceid=CA:en"
}, {
"date_added": "13282342527623442",
"guid": "f690f411-6f29-4e22-bee4-d57b225a9287",
"id": "10",
"name": "Stack Overflow - Where Developers Learn, Share, & Build Careers",
"show_icon": false,
"source": "user_add",
"type": "url",
"url": "https://stackoverflow.com/"
}, {
"children": [ {
"date_added": "13282342544239807",
"guid": "bf6d87ae-9cd1-4d02-b2de-5083e9b487f1",
"id": "12",
"name": "Amazon.ca: Low Prices – Fast Shipping – Millions of Items",
"show_icon": false,
"source": "user_add",
"type": "url",
"url": "https://www.amazon.ca/"
}, {
"date_added": "13282342551951302",
"guid": "d504da5d-4217-4a79-998c-f3dd5b0c95e0",
"id": "13",
"name": "Best Buy: Shop Online For Deals & Save | Best Buy Canada",
"show_icon": false,
"source": "user_add",
"type": "url",
"url": "https://www.bestbuy.ca/en-ca"
}, {
"date_added": "13282342564797804",
"guid": "cad2d5d7-c72e-477e-854a-d58df397574c",
"id": "15",
"name": "Laptops, Desktops, Tablets, Computer Components, Printers, TVs, Video Games & Appliances - Canada Computers & Electronics",
"show_icon": false,
"source": "user_add",
"type": "url",
"url": "https://www.canadacomputers.com/"
} ],
"date_added": "13282342538649786",
"date_modified": "13282342564797804",
"guid": "3616a33e-7bf6-47de-8142-673cc19f6d64",
"id": "11",
"name": "Shopping",
"source": "unknown",
"type": "folder"
} ],
"date_added": "13282342417969383",
"date_modified": "13282342544239807",
"guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",
"id": "1",
"name": "Favorites bar",
"source": "unknown",
"type": "folder"
},
"other": {
"children": [ ],
"date_added": "13282342417969428",
"date_modified": "0",
"guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",
"id": "2",
"name": "Other favorites",
"source": "unknown",
"type": "folder"
},
"synced": {
"children": [ ],
"date_added": "13282342417969430",
"date_modified": "0",
"guid": "4cf2e351-0e85-532b-bb37-df045d8f8d0f",
"id": "3",
"name": "Mobile favorites",
"source": "unknown",
"type": "folder"
}
},
"version": 1
}
As #zetta42 points out, it is likely that you just need to add more depth:
#($data2) | ConvertTo-Json -Depth 10 | Out-File $BackupStore/Bookmarks
as well as overwriting the roots property (not actually merging).
However, from a user experience you may want to consider another update. Right now if the two contain bookmarks of the same name, your intended merge logic will overwrite one with the other. A user (you) may be a whole lot happier knowing which browser a given bookmark came from and can easily re-organize from within the new browser (or, since I am not familiar with it, hopefully it does) if not desired. So I would suggest grabbing the the two bookmarks and putting them under their own folders in the new bookmarks. Something like the following:
Function Combine-Bookmarks {
# referenced https://www.jonathanmedd.net/2020/04/combine-two-json-files-with-powershell.html
#https://web.archive.org/web/20200517182000/https://www.jonathanmedd.net/2020/04/combine-two-json-files-with-powershell.html
if($chromeBookmarkExists -eq $true -And $edgeBookmarkExists -eq $true){
$data1 = Get-Content $BackupStore/Bookmarks-chrome.json -Raw | ConvertFrom-Json
$data2 = Get-Content $BackupStore/Bookmarks-edge.json -Raw | ConvertFrom-Json
$dataNew = #{
'roots'=#{'Chrome'=$data1.Roots; 'IE'=$data2.Roots}
#whatever the structure of the new json file should be
}
$dataNew | ConvertTo-Json -Depth 10 | Out-File $BackupStore/Bookmarks_new.json
}
}
Also you can either leave a folder blank if they don't have that browser, or you can exclude it from the $dataNew (by using a bit of different syntax I don't recall). Right now it will only attempt a merge if both exist.
i can't parse this json with logstash... someone could help me?
seems like the way it is parsed can't be readed by logstash.
there is a ruby code to parse this?
I cannot extract the fields nested in the square brackets
[
{
"capacity": 0,
"created_at": "2021-04-06T16:18:34+02:00",
"decisions": [
{
"duration": "22h16m4.141220361s",
"id": 842,
"origin": "CAPI",
"scenario": "crowdsecurity/http-bad-user-agent",
"scope": "ip",
"simulated": false,
"type": "ban",
"value": "3.214.184.223/32"
},
.
.
.
{
"duration": "22h16m4.195897491s",
"id": 904,
"origin": "CAPI",
"scenario": "crowdsecurity/http-backdoors-attempts",
"scope": "ip",
"simulated": false,
"type": "ban",
"value": "51.68.11.195/32"
}
],
"events": null,
"events_count": 0,
"id": 12,
"labels": null,
"leakspeed": "",
"machine_id": "N/A",
"message": "",
"scenario": "update : +63/-0 IPs",
"scenario_hash": "",
"scenario_version": "",
"simulated": false,
"source": {
"scope": "Community blocklist",
"value": ""
},
"start_at": "2021-04-06 16:18:34.750588276 +0200 +0200",
"stop_at": "2021-04-06 16:18:34.750588717 +0200 +0200"
}
]
Require JSON
JSON.parse(yourString)
Would likely be what you're looking for.
The module is described here
I am using GCP's BigQuery. I want to remove access of someone. Per https://cloud.google.com/bigquery/docs/dataset-access-controls#bq_1, I run the command
bq show \
--format=prettyjson \
project1:dataset1 > /tmp/myjson.json
and here is the JSON I get
{
"access": [
{
"role": "WRITER",
"specialGroup": "projectWriters"
},
{
"role": "OWNER",
"specialGroup": "projectOwners"
},
{
"role": "OWNER",
"userByEmail": "employee1#myco.com"
},
{
"role": "READER",
"specialGroup": "projectReaders"
}
],
"creationTime": "1528762487037",
"datasetReference": {
"datasetId": "dataset1",
"projectId": "project1"
},
"description": "My Data",
"etag": "<redacted>",
"friendlyName": "dataset1",
"id": "project1:dataset1",
"kind": "bigquery#dataset",
"lastModifiedTime": "1528762487037",
"location": "US",
"selfLink": "https://bigquery.googleapis.com/bigquery/v2/projects/project1/datasets/dataset1"
}
I an new to powershell and am trying to remove the entry for employee1, and put the json back for the
bq update
command per the link above.
Any ideas how to get the index of the entry.
I have tried to just get the "access" part of the json as an Array object. But the challenge is to find the employee1 entry index and remove that Array member and put it back into the json.
Any help is appreciated.
Using the convertfrom-json cmdlet, you get an object you can edit. Then you can convert it back using convertto-json
$x=#'
{
"access": [
{
"role": "WRITER",
"specialGroup": "projectWriters"
},
{
"role": "OWNER",
"specialGroup": "projectOwners"
},
{
"role": "OWNER",
"userByEmail": "employee1#myco.com"
},
{
"role": "READER",
"specialGroup": "projectReaders"
}
],
"creationTime": "1528762487037",
"datasetReference": {
"datasetId": "dataset1",
"projectId": "project1"
},
"description": "My Data",
"etag": "<redacted>",
"friendlyName": "dataset1",
"id": "project1:dataset1",
"kind": "bigquery#dataset",
"lastModifiedTime": "1528762487037",
"location": "US",
"selfLink": "https://bigquery.googleapis.com/bigquery/v2/projects/project1/datasets/dataset1"
}
'# | ConvertFrom-json
$x.Access=$x.Access.Where({$_.userByEmail -ne 'employee1#myco.com'})
$x | convertto-json
I have a list of dictionaries (basically JSON Response of an endpoint)
I would need to Parse this 16000 lines of json objects and fitler the documents/objects which match criteria that
whose leaf element/field : statusInfo/status in not "UP" and of those filtered objects, just return "name" , "serviceUrl","status"
example :
"ADMIN-V1" "http://aws-ec2.aws.com:4435" "Warning"
I have been researching about JSONPath module , but there is no good documentation about it, and I could not find any easier way.
Any guidance is highly appreciated.
here is a snippet from long 16000 lines of JSON response.
[
{
"id": "9c108ec5",
"name": "USER-V2",
"managementUrl": "http://aws-ec2.aws.com:5784/",
"healthUrl": "http://aws-ec2.aws.com:5784/health",
"serviceUrl": "http://aws-ec2.aws.com:5784/",
"statusInfo": {
"status": "UP",
"timestamp": 1566663146681,
"details": {
"description": " Eureka Discovery Client",
"status": "UP"
}
},
"source": "discovery",
"metadata": {},
"info": {
"component": "user",
"description": "User REST Resource",
"version": "2.2.1",
"git": {
"commit": {
"time": "07/27/2018 # 15:06:55 CDT",
"id": "b2a1b37"
},
"branch": "refs/tags/v2.2.1"
}
}
},
{
"id": "1a381f20",
"name": "ADMIN-V1",
"managementUrl": "http://aws-ec2.aws.com:4435/",
"healthUrl": "http://aws-ec2.aws.com:4435/health",
"serviceUrl": "http://aws-ec2.aws.com:4435/",
"statusInfo": {
"status": "Warning",
"timestamp": 1566663146682,
"details": {
"description": "Spring Cloud Eureka Discovery Client",
"status": "Warning"
}
},
"source": "discovery",
"metadata": {},
"info": {
"description": "Exchange Admin REST Resource",
"api": {
"version": "1.2.1",
"name": "admin",
"link": "https://app.swaggerhub.com/apis/AWSExchange/admin/1.2.1"
},
"implementation": "admin",
"version": "1.1.0",
"git": {
"commit": {
"time": "01/04/2019 # 15:36:48 UTC",
"id": "39d5551"
},
"branch": "refs/tags/v1.1.0"
}
}
}
]
If your json file contains one big array, you'll want to stream that file in truncating out the array. Then use fromstream/1 to rebuild the objects and filtering them out as you go.
I don't have a representative file to test out the performance myself, but give this a try:
$ jq --stream -n 'fromstream(1|truncate_stream(inputs))
| select(.statusInfo.status != "UP")
| .name, .serviceUrl, .statusInfo.status
' input.json