How do I print the keyS from a json object using JQ - json

Sample input
{
“event_timestamp”: “2016-03-16 13:19:53 UTC”,
“query”: “Plagiarism”,
“search_session_id”: “3605862756e95d26ac180",
“version”: “0.0.2",
“other”: “{\“client_timestamp\“:1458134393.932,\"ios_page_index\":3}“,
“action”: “HIT_BOUNCE”
}
{
“event_timestamp”: “2016-03-16 13:19:53 UTC”,
“query”: “Plagiarism”,
“search_session_id”: “3605862756e95d26ac180",
“version”: “0.0.2",
“other”:“{\“client_timestamp\“:1458134393.932,\"ios_page_index\":3,\"ios_index_path_row\":1}“,
“action”: “HIT_BOUNCE”
}
I'd like to output the unique key name in "other" field
"client_timestamp,
ios_page_index,
ios_index_path_row "
Tried the following command but doesn't work so far
cat sampleexample.json | jq '.other|keys' | sort | uniq > other.json
Thanks in advance

The sample input is not JSON, which does not allow fancy quotes to be used as string delimiters. The following assumes the input has been corrected.
The value of .other is a JSON string; you can use fromjson to change the string to a JSON object.
sort|unique is redundant, as unique first sorts its input.
Putting it all together:
$ jq '.other | fromjson | keys_unsorted | unique' input.json
[
"client_timestamp",
"ios_page_index"
]
[
"client_timestamp",
"ios_index_path_row",
"ios_page_index"
]
(Using keys_unsorted saves one sort operation.)

Related

jq - Looping through json and concatenate the output to single string

I was currently learning the usage of jq. I have a json file and I am able to loop through and filter out the values I need from the json. However, I am running into issue when I try to combine the output into single string instead of having the output in multiple lines.
File svcs.json:
[
{
"name": "svc-A",
"run" : "True"
},
{
"name": "svc-B",
"run" : "False"
},
{
"name": "svc-C",
"run" : "True"
}
]
I was using the jq to filter to output the service names with run value as True
jq -r '.[] | select(.run=="True") | .name ' svcs.json
I was getting the output as follows:
svc-A
svc-C
I was looking to get the output as single string separated by commas.
Expected Output:
"svc-A,svc-C"
I tried to using join, but was unable to get it to work so far.
The .[] expression explodes the array into a stream of its elements. You'll need to collect the transformed stream (the names) back into an array. Then you can use the #csv filter for the final output
$ jq -r '[ .[] | select(.run=="True") | .name ] | #csv' svcs.json
"svc-A","svc-C"
But here's where map comes in handy to operate on an array's elements:
$ jq -r 'map(select(.run=="True") | .name) | #csv' svcs.json
"svc-A","svc-C"
Keep the array using map instead of decomposing it with .[], then join with a glue string:
jq -r 'map(select(.run=="True") | .name) | join(",")' svcs.json
svc-A,svc-C
Demo
If your goal is to create a CSV output, there is a special #csv command taking care of quoting, escaping etc.
jq -r 'map(select(.run=="True") | .name) | #csv' svcs.json
"svc-A","svc-C"
Demo

How to convert arbitrary nested JSON to CSV with jq – so you can convert it back?

How do I use jq to convert an arbitrary JSON array of objects to CSV, while objects in this array are nested?
StackOverflow has a sea of questions/answers where specific input or output fields are referenced, but I'd like to have a generic solution that
includes a header row,
works for any JSON input including nested arrays + objects,
allows records that have missing values for keys that are present in other records
does not hard-code any field names,
allows converting the CSV back into the nested JSON structure if needed, and
uses key paths as header names (see the following description).
Dot notation
Many JSON-using products (like CouchDB, MongoDB, …) and libraries (like Lodash, …) use variations of syntax that allows access to nested property values / subfields by joining key fragments with a character, often a dot (‘dot notation’).
An example of a key path like this would be "a.b.0.c" to refer to the deeply nested property in this JSON snippet:
{
"a": {
"b": [
{
"c": 123,
}
]
}
}
Caveat: Using this method is a pragmatic solution for most cases, but means that either dot characters have to be banned in property names, or a more complex (and definitely never used property name) has to be invented for escaping dots in property names / accessing nested fields. MongoDB simply banned usage of "." in documents until v5.0, some libraries have workarounds for field access (Lodash example).
Despite this, for simplicity, a solution should use the described dot syntax in the CSV output’s header for nested properties. Bonus if there is a solution variant that solves this problem, e.g. with JSONPath.
Example JSON array as input
[
{
"a": {
"b": [
{
"c": 123
}
]
}
},
{
"a": {
"b": [
{
"c": "foo \" bar",
"d": "qux"
}
]
}
},
{
"a": {
"b": [
{
"d": 456
}
]
}
}
]
Example CSV output
The output should have a header that includes all fields (even if the object at the first array does not have defined values for all existing key paths).
To make the output intuitively editable by humans, each row should represent one object in the input array.
The expected output should look like this:
"a.b.0.c","a.b.0.d"
123,
"foo "" bar","qux"
,456
Command line
This is what I need:
cat example.json | jq <MISSING CODE HERE>
Solution 1, using dot notation
Here is the jq call to convert your array of nested JSON objects to CSV:
jq -r '(. | map(leaf_paths) | unique) as $cols | map (. as $row | ($cols | map(. as $col | $row | getpath($col)))) as $rows | ([($cols | map(. | map(tostring) | join(".")))] + $rows) | map(#csv) | .[]
The fastest way to try this solution out is to use JQPlay.
The CSV output will have a header row. It will contain all properties that exist anywhere in the input objects, including nested ones, in dot notation. Each input array element will be represented as a single row, properties that are missing will be represented as empty CSV fields.
Using solution 1 in bash or a similar shell
Create the JSON input file…
echo '[{"a": {"b": [{"c": 123}]}},{"a": {"b": [{"c": "foo \" bar","d": "qux"}]}},{"a": {"b": [{"d": 456}]}}]' > example.json
Then use this jq command to output the CSV on the standard output:
cat example.json | jq -r '(. | map(leaf_paths) | unique) as $cols | map (. as $row | ($cols | map(. as $col | $row | getpath($col)))) as $rows | ([($cols | map(. | map(tostring) | join(".")))] + $rows) | map(#csv) | .[]'
…or write the output to example.csv:
cat example.json | jq -r '(. | map(leaf_paths) | unique) as $cols | map (. as $row | ($cols | map(. as $col | $row | getpath($col)))) as $rows | ([($cols | map(. | map(tostring) | join(".")))] + $rows) | map(#csv) | .[]' > example.csv
Converting the data from solution 1 back to JSON
Here is a Node.js example that you can try on RunKit. It converts a CSV generated with the method in solution 1 back to an array of nested JSON objects.
Explanation for solution 1
Here is a longer, commented version of the jq filter.
# 1) Find all unique leaf property names of all objects in the input array. Each nested property name is an array with the components of its key path, for example ["a", 0, "b"].
(. | map(leaf_paths) | unique) as $cols |
# 2) Use the found key paths to determine all (nested) property values in the given input records.
map (. as $row | ($cols | map(. as $col | $row | getpath($col)))) as $rows |
# 3) Create the raw output array of rows. Each row is represented as an array of values, one element per existing column.
(
# 3.1) This represents the header row. Key paths are generated here.
[($cols | map(. | map(tostring) | join(".")))]
+ # 3.2) concatenate the header row with all other rows
$rows
)
# 4) Convert each row to a escaped CSV string.
| map(#csv)
# 5) output each array element directly. Without this, the result would be a JSON array of CSV strings.
| .[]
Solution 2: for input that does have dots in property names
If you do need to support dot characters in property names, you can either use a different separator string for the key path syntax (replace the dot in "." with something else), or replace the map(tostring) | join(".") part with tostring - this yields a JSON array of strings that you can use as key paths - no dot notation needed. Here is a JQPlay with this solution variant.
Full jq command:
jq -r (. | map(leaf_paths) | unique) as $cols | map (. as $row | ($cols | map(. as $col | $row | getpath($col)))) as $rows | ([($cols | map(. | tostring))] + $rows) | map(#csv) | .[]
The output CSV for the variant would look like this then – it’s less readable and not useful for cases where you want humans to intuitively understand the CSV’s header:
"[""a"",""b"",0,""c""]","[""a"",""b"",0,""d""]"
123,
"foo "" bar","qux"
,456
See below for an idea how to convert this format back to a representation in your programming language.
Bonus: Converting the generated CSV back to JSON
If the input's nested properties contain no ".", it’s simple to convert the CSV back to JSON, for example with a library that supports dot notation, or with JSONPath.
JavaScript: Use Lodash's _.set()
Other languages: Find a package/library that implements JSONPath and use selectors like $.a.b.0.c or $['a']['b'][0]['c'] to set each nested property of each record.
Solution 2 (with JSON arrays as headers) allows you to interpret the headers as JSON array strings. Then you can generate a JSON Path from each header, and re-create all records/objects:
"[""a"",""b"",0,""c""]" (CSV)
→ ["a","b",0,"c"] (array of key-path components after unescaping and parsing as JSON)
→ $.["a"]["b"][0]["c"] (JSONPath)
→ { a: { b: [{c: … }] } } (Nested regenerated object)
I've written an example Node.js script to convert a CSV like this back to JSON. You can try solution 2 in RunKit.
The following tocsv and fromcsv functions provide a solution to the stated problem except for one complication regarding requirement (6) concerning the headers. Essentially, this requirement can be met using the functions given here by adding a matrix transposition step.
Whether or not a transposition step is added, the advantage of the approach taken here is that there are no restrictions on the JSON keys or values. In particular, they may
contain periods (dots), newlines and/or NUL characters.
In the example, an array of objects is given, but in fact any stream of valid JSON documents could be used as input to tocsv; thanks to the magic of jq, the original stream will be recreated by fromcsv (in the sense of entity-by-entity equality).
Of course, since there is no CSV standard, the CSV produced by the
tocsv function might not be understood by all CSV processors. In
particular, please note that the tocsv function defined here maps
embedded newlines in JSON strings or key names to the two-character
string "\n" (i.e., a literal backslash followed by the letter "n");
the inverse operation performs the inverse translation to meet the
"round-trip" requirement.
(The use of tail is just to simplify the presentation; it would be
trivial to modify the solution to make it an only-jq one.)
The CSV is generated on the assumption that any value can be
included in a field so long as (a) the field is quoted, and (b)
double-quotes within the field are doubled.
Any generic solution that supports "round-trips" is bound to be
somewhat complicated. The main reason why the solution presented here is
more complex than one might expect is because a third column is
added, partly to make it easy to distinguish between integers and
integer-valued strings, but mainly because it makes it easy to
distinguish between the size-1 and size-2 arrays produced by jq's
--stream option. Needless to say, there are other ways
these issues could be addressed; the number of calls to jq could
also be reduced.
The solution is presented as a test script that checks the round-trip requirement on a telling test case:
#!/bin/bash
function json {
cat<<EOF
[
{
"a": 1,
"b": [
1,
2,
"1"
],
"c": "d\",ef",
"embed\"ed": "quote",
"null": null,
"string": "null",
"control characters": "a\u0000c",
"newline": "a\nb"
},
{
"x": 1
}
]
EOF
}
function tocsv {
jq -ncr --stream '
(["path", "value", "stringp"],
(inputs | . + [.[1]|type=="string"]))
| map( tostring|gsub("\"";"\"\"") | gsub("\n"; "\\n"))
| "\"\(.[0])\",\"\(.[1])\",\(.[2])"
'
}
function fromcsv {
tail -n +2 | # first duplicate backslashes and deduplicate double-quotes
jq -rR '"[\(gsub("\\\\";"\\\\") | gsub("\"\"";"\\\"") ) ]"' |
jq -c '.[2] as $s
| .[0] |= fromjson
| .[1] |= if $s then . else fromjson end
| if $s == null then [.[0]] else .[:-1] end
# handle newlines
| map(if type == "string" then gsub("\\\\n";"\n") else . end)' |
jq -n 'fromstream(inputs)'
}
# Check the roundtrip:
json | tocsv | fromcsv | jq -s '.[0] == .[1]' - <(json)
Here is the CSV that would be produced by json | tocsv, except that SO seems to disallow literal NULs, so I have replaced that by \0:
"path","value",stringp
"[0,""a""]","1",false
"[0,""b"",0]","1",false
"[0,""b"",1]","2",false
"[0,""b"",2]","1",true
"[0,""b"",2]","false",null
"[0,""c""]","d"",ef",true
"[0,""embed\""ed""]","quote",true
"[0,""null""]","null",false
"[0,""string""]","null",true
"[0,""control characters""]","a\0c",true
"[0,""newline""]","a\nb",true
"[0,""newline""]","false",null
"[1,""x""]","1",false
"[1,""x""]","false",null
"[1]","false",null

Convert a flat JSON to a TSV file with column headers

I am reformatting some JSON with JQ into a TSV file. I am able to create a TSV with the values only, but I cannot figure out how to include a single row with the key values as column headers?
Sample input:
{
"id":"1234",
"host":"6789",
"proto":"UDP",
"location":"Boston",
"timestamp":"2020-12-01T14:18:45.717Z",
"src_ip":"192.168.3.70",
"dest_ip":"8.8.8.8",
"dest_port":53,
"message":"Some Information",
"severity":1,
"details":"Some Details",
"categories":["a","b","c"]
}
Desired output:
"location\ttimestamp\tsrc_ip\tdest_ip\tdest_port"
"Boston\t2020-12-01T15:13:16.242Z\t10.8.25.63\t10.8.1.3\t445"
"Atlanta\t2020-12-01T15:11:15.929Z\t10.8.25.63\t10.80.1.3\t445"
"Chicago\t2020-12-01T15:09:45.271Z\t10.34.196.12\t10.8.1.3\t445"
This statement gets me close:
cat input.json | jq '. | to_entries
| map(select(.key=="timestamp"), select(.key=="location"), select(.key=="src_ip"), select(.key=="dest_ip"), select(.key=="dest_port"))
| map(.key), map(.value)
| #tsv'
But the header line is repeated in the output:
"location\ttimestamp\tsrc_ip\tdest_ip\tdest_port"
"Boston\t2020-12-01T15:13:16.242Z\t10.8.25.63\t10.8.1.3\t445"
"location\ttimestamp\tsrc_ip\tdest_ip\tdest_port"
"Atlanta\t2020-12-01T15:11:15.929Z\t10.8.25.63\t10.80.1.3\t445"
Is there a way to print the keys on the first row only, and then print only the values on the remaining rows, using only JQ?
One way to make such a flat object JSON to a TSV format, using the #tsv function would be to do
jq -n ' ["location", "timestamp", "src_ip", "dest_ip", "dest_port"] as $hdr |
$hdr, ( inputs | [ .[ $hdr[] ] ] ) | #tsv'
This works, by reusing the key fields as in the header, .[ $hdr[] ] is a simple trick to expand values of each of the literal fields in the hdr array to their corresponding values in the object (see Generic Object Index). By surrounding it in the brackets, you get the selected field values in an array. With this array collected and the header array, apply the #tsv function to get the tabular form.
jq play snippet - Demo

How to access the value of an unknown key?

I have the following JSON file
{
"https://test.com/gg": [
"msg",
"popup",
"url"
]
}
What I want to achieve is to parse the values to output the following
https://test.com/gg?msg=gg
https://test.com/gg?popup=gg
https://test.com/gg?url=gg
I'm assuming it can be done using jq but I'm not sure how.
The way i know is if the elemets were named like bellow:
{
"url":"https://test.com/gg": [
"p1":"msg",
]
}
I would pull the elements like:
cat json | jq "url.[p1]"
But in my case is it not named.
jq --raw-output 'to_entries[0] | .key as $url | .value[] | "\($url)?\(.)=gg"' <your json file here>
Where
to_entries[0] yields {"key":"https://test.com/gg","value":["msg","popup","url"]}
(Save .key as $url for later)
Then "emit" all values with .value[]
For each "emitted" value, produce the string "\($url)?\(.)=gg" where . is the current value

error in parsing JSON value

Somehow, I'm not able to parse values for the below JSON.
not able to get this qlog.QBOL-QUERY-SCHEMA value(getting string invalid
error)
I was looking for something output like this:
id:104909913,QBOL-QUERY-SCHEMA:/tmp/2017-10-31/5031/104909913.dir/000
JSON file:
{
"id":104909913,
"path":"/tmp/2017-10-31/5031/104909913",
"status":"done",
"created_at":"2017-10-31T05:03:19Z",
"updated_at":"2017-10-31T05:10:24Z",
"command_type":"HiveCommand",
"progress":100,
"qbol_session_id":6527670,
"qlog":"{\"QBOL-QUERY-SCHEMA\":{\"/tmp/2017-10-31/5031/104909913.dir/000\":[{\"ColumnType\":\"string\",\"ColumnName\":\"ts_date\"},{\"ColumnType\":\"bigint\",\"ColumnName\":\"testing_requests\"},{\"ColumnType\":\"bigint\",\"ColumnName\":\"testings_placed\"}]},\"EXECUTION_ENGINE\":\"mr\",\"QBOL-S3N-BYTES-READ\":1258754351,\"QBOL-S3N-BYTES-WRITTEN\":224,\"HIVE_VERSION\":\"0.13\"}",
"resolved_macros":null,
"pid":27212,
"template":"generic",
"submit_time":1509426199,
"start_time":1509426202,
"end_time":1509426624,
"can_notify":false,
"num_result_dir":1,
"pool":null,
"timeout":null,
"name":null,
"command_source":"API",
"account_id":5031,
"saved_query_mutable_id":null,
"user_id":12146,
"label":"default",
"meta_data":{
"results_resource":"commands/104909913/results",
"logs_resource":"commands/104909913/logs"
},
"uid":5164,
"perms":null,
"command":{
"query":"select * from abc ",
"sample":false,
"approx_mode":false,
"approx_aggregations":false,
"loader_table_name":null,
"loader_stable":null,
"md_cmd":false,
"script_location":null
},
"instance":null
}
Thanks for the help!
glog property within your input object contains JSON text representation, in "unparsed" form.
To parse JSON text representation into values use fromjson function:
jq -r '"id:\(.id),QBOL-QUERY-SCHEMA:\(.qlog | fromjson | .["QBOL-QUERY-SCHEMA"] | keys[0])"' input.json
The output:
id:104909913,QBOL-QUERY-SCHEMA:/tmp/2017-10-31/5031/104909913.dir/000
Here is a more programmatic approach (that is, the jq program does not mention the "QBOL-QUERY-SCHEMA" key explicitly). Whether this meets your actual needs, however, is unclear.
"id:\(.id)," +
(.qlog | fromjson | to_entries[0] | .key + ":" +
(.value | to_entries[0] | .key) )
When jq is invoked with the -r option, this yields:
id:104909913,QBOL-QUERY-SCHEMA:/tmp/2017-10-31/5031/104909913.dir/000