我想做什么?
给出一个json事件的文件。我想按关键字找到特定事件,然后用“”替换该事件中的key值。 这必须用sed完成(Splunk转发问题..我不会厌烦你的细节)。
示例事件
{
"message":"we have a response from SomeService",
"other":"some stuff",
"other2":"some other stuff",
"xml":"<Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:awsse=\"http://xml.chicken.com/2010/06/Session_v3\" xmlns:wsa=\"http://www.w3.org/2005/08/addressing\"><Header><To>http://www.w3.org/2005/08/addressing/anonymous</To><From><Address>..... AND SO ON BIG GIANT NASTEY XML",
"other3":"even more stuff"
}
期望的结果
{
"message":"we have a response from SomeService",
"other":"some stuff",
"other2":"some other stuff",
"xml":"",
"other3":"even more stuff"
}
我尝试了什么? 我可以隔离事件并更换密钥没问题。我正在努力使用正则表达式替换json中键的值。
cat test.json | sed '/"we have a response from SomeService"/ s/other2/chicken/'
Thansk为你提供帮助!
答案 0 :(得分:2)
从评论中复制
你可以试试这个
cat test.json | sed '/"xml":/ s/"xml":[^,]*/"xml":""/'
[^,]*
会匹配所有内容,直到找到,
。