I have a file created by doing an XHR fetch of XML and parsing it through the node module xlm2js and then JSON.stringify. It has about 700 segments of two basic types. This is an edited version of the file with one segment of each type:
{
"NewDataSet": {
"Table": [
{
"SegmentID": [
"2342"
],
"StationID": [
"005es00045:_MN_Stn"
],
"SegmentName": [
"I-5 NB MP0.45 # SR-14"
],
"SegmentType": [
"2"
],
"SegmentLength": [
"1135"
],
"MinimumLanesReporting": [
"0.5"
],
"CalculationThreshold": [
"30"
],
"CalculationPeriod": [
"2"
],
"MinimumSamples": [
"3"
],
"SegmentMaximumFilter": [
"774"
],
"SegmentMinimumFilter": [
"12"
],
"StandardDeviationSamples": [
"15"
],
"StandardDeviationMultiplier": [
"1.96"
],
"UseStandardDeviationFilter": [
"false"
],
"IsActive": [
"true"
]
},
{
"SegmentID": [
"3051"
],
"BeginningDcuID": [
"584"
],
"EndDcuID": [
"589"
],
"SourceSystem": [
"TravelTime"
],
"SegmentName": [
"OR212 at SE 242nd Ave to OR212 at SE Foster Rd"
],
"SegmentType": [
"1"
],
"SegmentLength": [
"100"
],
"CalculationThreshold": [
"60"
],
"CalculationPeriod": [
"10"
],
"MinimumSamples": [
"3"
],
"SegmentMaximumFilter": [
"3600"
],
"SegmentMinimumFilter": [
"50"
],
"StandardDeviationSamples": [
"20"
],
"StandardDeviationMultiplier": [
"1.96"
],
"UseStandardDeviationFilter": [
"true"
],
"IsActive": [
"true"
]
}
]
}
}
I need to ignore the "SegmentType":["2"] segments and extract SegmentID, SegmentName, BeginningDcuID, EndingDcuID, and SegmentLength from the type 1 segments where IsActive is true.
I can list the file with jq "." but any attempt at other operations with jq fail, usually with the message:
'jq: error: syntax error, unexpected '[' (Unix shell quoting issues?) at , line 1:'
Any suggestions for jq syntax changes or xml2js parameter changes to make this work would be outstandingly helpful.
Never use double quotes for quoting an argument if there is nothing in it that you want the shell to expand.
$ jq '.NewDataSet.Table[]
| select(.SegmentType[0] != "2" and .IsActive[0] == "true")
| (.SegmentID, .SegmentName, .BeginningDcuID, .EndingDcuID, .SegmentLength)[0]' file
"3051"
"OR212 at SE 242nd Ave to OR212 at SE Foster Rd"
"584"
null
"100"
Related
Consider the below string
date 00:00 1.1.1.1 POST test.com hello-world
How could I print only the date totaltime and URL(test.com) using grok?
Given the sample above
^%{DATA:date} %{DATA:time} %{IP:ip} %{DATA:method} %{DATA:url} %{GREEDYDATA:path}$
would generate:
{
"date": [
[
"date"
]
],
"time": [
[
"00:00"
]
],
"ip": [
[
"1.1.1.1"
]
],
"method": [
[
"POST"
]
],
"url": [
[
"test.com"
]
],
"path": [
[
"hello-world"
]
]
}
Afterwards you can mutate it whichever form you want
i want to access the particular userid details
[
{
"userID": 998926445,
"contentID": [
[
"5bbae768c1df412352000004"
],
[
"5ba8d4fac1df413dae0002cf"
],
[
"5ca61afced8f7d3a5f00102d"
],
[
"5b9c9cacc1df41453400003f"
],
[
"5c8a8044a58c4046b30030f2"
],
[
"5ba9070bc1df413dae0003c3"
],
[
"5bbb1087c1df4140a6000162"
],
[
"5c95142bed8f7d5ede004ef4"
],
[
"5ba905e5c1df413dae0003b9"
],
[
"5bb89799c1df41262300062a"
]
]
},
{
"userID": 998926445,
"contentID": [
[
"5baa8ef5c1df41479a0004b8"
],
[
"5c8a8063a58c4046c8000e89"
],
[
"5bbc7a16c1df412a82000008"
],
[
"5bb8964ec1df41262300060c"
],
[
"5bbc4f92c1df4140a6000abe"
],
[
"5bbb0ecbc1df4140a60000fc"
],
[
"5ba90aa2c1df413dae000429"
],
[
"5bf2bb06c1df411238003054"
],
[
"5cb0c006ed8f7d6a1d00146a"
],
[
"5bbc9825c1df41384100024c"
]
]
},
{
"userID": 998926445,
"contentID": [
[
"5bb8974cc1df412623000622"
],
[
"5b9c9cadc1df414534000047"
],
[
"5b8e5b32c1df412918000048"
],
[
"5b9c9cacc1df41453400003f"
],
[
"5bb8ac8ac1df4126230008a0"
],
[
"5b9fad7bc1df4145340000a7"
],
[
"5bbb1171c1df4140a600016c"
],
[
"5c8a8071a58c4046c8000e8d"
],
[
"5ba90dbac1df413dae00043d"
],
[
"5ba8f905c1df413dae000397"
]
]
}
Try to do something like this. You will get the list. then you can work on fixing it. Let us assume json_list is your original json list.
from collections import defaultdict
dd = defaultdict(list)
for i in json_list:
dd[i['userID']].append([j[0] for j in i['contentID']])
dd = dict(dd)
print(dd)
Your output will be something like this:
{998926445: [['5bbae768c1df412352000004', '5ba8d4fac1df413dae0002cf', '5ca61afced8f7d3a5f00102d', '5b9c9cacc1df41453400003f', '5c8a8044a58c4046b30030f2', '5ba9070bc1df413dae0003c3', '5bbb1087c1df4140a6000162', '5c95142bed8f7d5ede004ef4', '5ba905e5c1df413dae0003b9', '5bb89799c1df41262300062a'], ['5baa8ef5c1df41479a0004b8', '5c8a8063a58c4046c8000e89', '5bbc7a16c1df412a82000008', '5bb8964ec1df41262300060c', '5bbc4f92c1df4140a6000abe', '5bbb0ecbc1df4140a60000fc', '5ba90aa2c1df413dae000429', '5bf2bb06c1df411238003054', '5cb0c006ed8f7d6a1d00146a', '5bbc9825c1df41384100024c'], ['5bb8974cc1df412623000622', '5b9c9cadc1df414534000047', '5b8e5b32c1df412918000048', '5b9c9cacc1df41453400003f', '5bb8ac8ac1df4126230008a0', '5b9fad7bc1df4145340000a7', '5bbb1171c1df4140a600016c', '5c8a8071a58c4046c8000e8d', '5ba90dbac1df413dae00043d', '5ba8f905c1df413dae000397']]}
This is the sample log pattern I'm parsing. I'm using grok but it's not exactly as what I expected
180528 8:46:26 2 Query SELECT 1
To parse this log my grok pattern is
%{NUMBER:date} %{NOTSPACE:time}%{INT:pid}%{GREEDYDATA:message}
and output for this in grok debugger is
> { "date": [
> [
> "180528"
> ] ], "time": [
> [
> "8:46:2"
> ] ], "pid": [
> [
> "6"
> ] ], "message": [
> [
> " 2 Query\tSELECT 1"
> ] ] }
If you observe in the output, pid is being extracted from time and actual pid which is 2 is being merged in the message. Not sure what went wrong here.
Why can't you just match your time with TIME pattern instead? it doesn't make sense to match it with NOTSPACE which equals to \S+, and matches any non-whitespace character (equal to [^\r\n\t\f\v ])
You can use TIME pattern for your time value and INT for pid as follows,
%{NUMBER:date}\s%{TIME:time}\s%{INT:pid}\s%{GREEDYDATA:message}
This will give you,
{
"date": [
[
"180528"
]
],
"BASE10NUM": [
[
"180528"
]
],
"time": [
[
"8:46:26"
]
],
"HOUR": [
[
"8"
]
],
"MINUTE": [
[
"46"
]
],
"SECOND": [
[
"26"
]
],
"pid": [
[
"2"
]
],
"message": [
[
"Query SELECT 1"
]
]
}
I am trying to filter out logs received with the help of grok. Below is the sample log
INFO | jvm 1 | main | 2013/04/05 01:08:47.048 | [m[32mINFO [TaskExecutor-master-2443-ProcessTask [31111111112]] [b2cConfirmationAction] CRON JOB ID : 101AA1C, ACTION : ConfirmationAction , CUSTOMER ID : 000001111111 , EMAIL ADDRESS : abc#gmail.com , SCHEDULE : Every 1 week , MESSAGE : Execution started for action ConfirmationAction
I am using grok debugger (https://grokdebug.herokuapp.com/) to test before updating logstash conf file.
Below is my filter code :
%{LOGLEVEL:level}%{GREEDYDATA:greedydata}%{SPACE}%{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}%{SPACE}%{HOUR}:%{MINUTE}:%{SECOND}%{GREEDYDATA:gd} \[(?:%{WORD:action})\]%{GREEDYDATA:cronjobresult}
Here I am getting outpout as
"level": [ [ "INFO" ] ], "greedydata": [ [ " | jvm 1 | main | 20" ] ], "SPACE": [ [ "", " " ] ], "YEAR": [ [ "13" ] ], "MONTHNUM": [ [ "04" ] ], "MONTHDAY": [ [ "05" ] ], "HOUR": [ [ "01" ] ], "MINUTE": [ [ "08" ] ], "SECOND": [ [ "47.048" ] ], "gd": [ [ " | \u001b[m\u001b[32mINFO [TaskExecutor-master-2443-ProcessTask [31111111112]]" ] ], "action": [ [ "b2cConfirmationAction" ] ], "cronjobresult": [ [ " CRON JOB ID : 101AA4A , ACTION : ConfirmationAction , CUSTOMER ID : 000001111111 , EMAIL ADDRESS : abc#gmail.com , SCHEDULE : Every 1 week , MESSAGE : Execution started for action ConfirmationAction" ] ] }
My requirement is to get values under cronjobresult like cron job iD customer id with different and independent field so that I can use these values in kibana. Right now I am not able to get it. Also I have used greedyData twice, better approach for this log would be appreciable.
You can simply extend your filter further and match it explicitly. For instance, to match cron job id, you can write CRON JOB ID : %{BASE16NUM:Cron_job_id} in your filter.
If you do not need any data from log then you can simply write .* instead of GREEDYDATA and it will be skipped.
Here is the complete filter for your log,
%{LOGLEVEL:level}%{GREEDYDATA:greedydata}%{SPACE}%{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}%{SPACE}%{HOUR}:%{MINUTE}:%{SECOND}%{GREEDYDATA:gd} \[(?:%{WORD:action})\] CRON JOB ID : %{BASE16NUM:Cron_job_id},.*CUSTOMER ID : %{NUMBER:Customer_id}.*EMAIL ADDRESS : %{EMAILADDRESS}.*SCHEDULE : %{GREEDYDATA:schedule}.*, MESSAGE : %{GREEDYDATA:Message}
Output:
{
"level": [
[
"INFO"
]
],
"greedydata": [
[
" | jvm 1 | main | 20"
]
],
"SPACE": [
[
"",
" "
]
],
"YEAR": [
[
"13"
]
],
"MONTHNUM": [
[
"04"
]
],
"MONTHDAY": [
[
"05"
]
],
"HOUR": [
[
"01"
]
],
"MINUTE": [
[
"08"
]
],
"SECOND": [
[
"47.048"
]
],
"gd": [
[
" | [m[32mINFO [TaskExecutor-master-2443-ProcessTask [31111111112]]"
]
],
"action": [
[
"b2cConfirmationAction"
]
],
"Cron_job_id": [
[
"101AA1C"
]
],
"Customer_id": [
[
"000001111111"
]
],
"BASE10NUM": [
[
"000001111111"
]
],
"EMAILADDRESS": [
[
"abc#gmail.com"
]
],
"local": [
[
"abc"
]
],
"remote": [
[
"gmail.com"
]
],
"schedule": [
[
"Every 1 week "
]
],
"Message": [
[
"Execution started for action"
]
]
}
Please note that I have used EMAILADDRESS pattern from, https://github.com/rgevaert/grok-patterns/blob/master/grok.d/postfix_patterns
If you want to test it on https://grokdebug.herokuapp.com, you need to add,
EMAILADDRESSPART [a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILADDRESSPART:local}#%{EMAILADDRESSPART:remote}
as cusomtom patterns by checking add custom patterns
My logs look as such
00009139 2015-03-03 00:00:20.142 5254 11607 "HTTP First Line: GET /?main&legacy HTTP/1.1"
I tried using grok debugger to get this information formatted with no success. Is there any way to get this format using grok? The quoted string would be the message
So I used the following formatting simply by using the grok patterns page.
%{NUMBER:Sequence} %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}? %{NUMBER:Process}%{NUMBER:Process2}%{WORD:Message}
This is the closest I could get with the current info.
%{INT}%{SPACE}%{TIMESTAMP_ISO8601}%{SPACE}%{INT:pid1}%{SPACE}%{INT:pid2}%{SPACE}%{GREEDYDATA:message}
With the above grok pattern, this is what the grokdebugger "catches":
{
"INT": [
[
"00009139"
]
],
"SPACE": [
[
" ",
" ",
" ",
" "
]
],
"TIMESTAMP_ISO8601": [
[
"2015-03-03 00:00:20.142"
]
],
"YEAR": [
[
"2015"
]
],
"MONTHNUM": [
[
"03"
]
],
"MONTHDAY": [
[
"03"
]
],
"HOUR": [
[
"00",
null
]
],
"MINUTE": [
[
"00",
null
]
],
"SECOND": [
[
"20.142"
]
],
"ISO8601_TIMEZONE": [
[
null
]
],
"pid1": [
[
"5254"
]
],
"pid2": [
[
"11607"
]
],
"message": [
[
""HTTP First Line: GET /?main&legacy HTTP/1.1""
]
]
}
Hope I was of some help.
Try to replace %{WORD:Message} at the end of your grok with %{QS:message}.
hope this helps :)