Skip to content

Commit

Permalink
Support nested parsing function
Browse files Browse the repository at this point in the history
Closes #6
  • Loading branch information
lowell80 committed Nov 9, 2018
1 parent 92149b1 commit e57eb27
Showing 1 changed file with 30 additions and 2 deletions.
32 changes: 30 additions & 2 deletions bin/jpath.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
# Version 1.0
import json
import os
import sys
Expand All @@ -11,9 +10,37 @@
sys.path.append(os.path.join(DIR, "lib"))

import jmespath
from jmespath import functions
from jmespath.exceptions import ParseError, JMESPathError, UnknownFunctionError


# Custom functions for the JMSEPath language to make some typical splunk use cases easier to manage
class JmesPathSplunkExtraFunctions(functions.Functions):

@functions.signature({'types': ['string', 'array']})
def _func_parse(self, s):
"""
Possible name options:
parse Nice, but parse what?
from_string Parity with to_string (exports data AS a json string)
from_json? Maybe more clear? not sure
unnest Can't get past the double "n"s
jsonstr My first option, but don't like it.
"""
# XXX: Figure out how to make this properly support (pass-through) a 'null' type
if s is None:
return None
if isinstance(s, (list,tuple)):
return [ json.loads(i) for i in s ]
try:
return json.loads(s)
except:
return s

jp_options = jmespath.Options(custom_functions=JmesPathSplunkExtraFunctions())



def flatten(container):
if isinstance(container, (list, tuple)):
for i in container:
Expand All @@ -26,6 +53,7 @@ def flatten(container):
yield str(container)



if __name__ == '__main__':
try:
keywords, options = si.getKeywordsAndOptions()
Expand Down Expand Up @@ -58,7 +86,7 @@ def flatten(container):
# Invalid JSON. Move on, nothing to see here.
continue
try:
values = jp.search(json_obj)
values = jp.search(json_obj, options=jp_options)
result[outfield] = list(flatten(values))
result[ERROR_FIELD] = None
added = True
Expand Down

0 comments on commit e57eb27

Please sign in to comment.