Question

我有一个对象列表，如下所示：

cat *

现在我想对组件进行分组和键入，并为每个组件分配一个ips列表：

[
  {
    "ip": "1.1.1.1",
    "component": "name1"
  },
  {
    "ip": "1.1.1.2",
    "component": "name1"
  },
  {
    "ip": "1.1.1.3",
    "component": "name2"
  },
  {
    "ip": "1.1.1.4",
    "component": "name2"
  }
]

Answer 1

我自己想通了。我首先按.component进行分组，然后创建由每个组的第一个对象的组件索引的新的ips列表：

jq ' group_by(.component)[] | {(.[0].component): [.[] | .ip]}'

Answer 2

作为@replay's technique的另一个示例，在使用其他方法多次失败之后，我最终构建了一个过滤器，以简化此Wazuh报告（为简洁起见而摘录）：

{
  "took" : 228,
  "timed_out" : false,
  "hits" : {
    "total" : {
      "value" : 2806,
      "relation" : "eq"
    },
    "hits" : [
      {
        "_source" : {
          "agent" : {
            "name" : "100360xx"
          },
          "data" : {
            "vulnerability" : {
              "severity" : "High",
              "package" : {
                "condition" : "less than 78.0",
                "name" : "Mozilla Firefox 68.11.0 ESR (x64 en-US)"
              }
            }
          }
        }
      },
      {
        "_source" : {
          "agent" : {
            "name" : "100360xx"
          },
          "data" : {
            "vulnerability" : {
              "severity" : "High",
              "package" : {
                "condition" : "less than 78.0",
                "name" : "Mozilla Firefox 68.11.0 ESR (x64 en-US)"
              }
            }
          }
        }
      },
      ...

这里是jq过滤器，我使用它来提供一组对象，每个对象由一个代理名称组成，后跟一个代理易受攻击软件包的名称数组：

jq ' .hits.hits |= unique_by(._source.agent.name, ._source.data.vulnerability.package.name) | .hits.hits | group_by(._source.agent.name)[] | { (.[0]._source.agent.name): [.[]._source.data.vulnerability.package | .name ]}'

以下是过滤器产生的输出的摘录：

{ "100360xx": [ "Mozilla Firefox 68.11.0 ESR (x64 en-US)", "VLC media player", "Windows 10" ] } { "WIN-KD5C4xxx": [ "Windows Server 2019" ] } { "fridxxx": [ "java-1.8.0-openjdk", "kernel", "kernel-headers", "kernel-tools", "kernel-tools-libs", "python-perf" ] } { "mcd-xxx-xxx": [ "dbus", "fribidi", "gnupg2", "graphite2", ...

jq：按属性分组和键

2 个答案: