Using jq to search value of a property and return another value

Question

Sorry if this sounds too simple but I am still learning and have spent few hours to get a solution. I have a large json file and I would like to search a specific value from an object and return value from other object.

Example, from the below data, I would like to search the json file for all objects that have value in unique_number that match "123456" and return this value along with the IP address. jq should return something like - 123456, 127.0.0.1 Since the file is going to be about 300 MB with many IP addresses will there be any performace issues?

Partial json -

{
  "ip": "127.0.0.1",
  "data": {
    "tls": {
      "status": "success",
      "protocol": "tls",
      "result": {
        "handshake_log": {
          "server_hello": {
            "version": {
              "name": "TLSv1.2",
              "value": 1111
            },
            "random": "dGVzdA==",
            "session_id": "dGVzdA==",
            "cipher_suite": {
              "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
              "value": 1122
            },
            "compression_method": 0,

          },
          "server_certificates": {
            "certificate": {
              "raw": "dGVzdA==",
              "parsed": {
                "version": 3,
                "unique_number": "123456",
                "signature_algorithm": {
                  "name": "SHA256-RSA",
                  "oid": "1.2.4.5.6"
                },

does jq stand for jquery? Is it the way you use jquery to get to work with the json: `var obj = jQuery.parseJSON(jsonString);` Could you please provide some examples on how you do it. Thanks! — igrek, Feb 06 '20 at 15:46
jq is command line processor for json. See this - https://stedolan.github.io/jq/ — jackemma, Feb 06 '20 at 16:01
Does this answer your question? [Select objects based on value of variable in object using jq](https://stackoverflow.com/questions/18592173/select-objects-based-on-value-of-variable-in-object-using-jq) — lojza, Feb 06 '20 at 16:38
Please give a more informative and more succinct example in accordance with the [mcve] guidelines. The sample JSON should be valid. — peak, Feb 07 '20 at 04:10

knittl · Answer 1 · 2022-09-10T17:07:52.427

The straight-forward way would be to use the select filter (either standalone on multiple values or with map on an array) and filter all objects matching your criterion (e.g. equal to "123456") and then transform into your required output format (e.g. using string interpolation).

jq -r '.[]
| select(.data.tls.result.handshake_log.server_certificates.certificate.parsed.unique_number=="123456")
| "\(.ip), \(.data.tls.result.handshake_log.server_certificates.certificate.parsed.unique_number)"'

Because the unique_number property is nested quite deeply and cumbersome to write twice, it makes sense to first transform your object into something simpler, then filter, and finally output in the desired format:

jq -r '.[]
| { ip, unique_number: .data.tls.result.handshake_log.server_certificates.certificate.parsed.unique_number }
| select(.unique_number=="123456")
| "\(.ip), \(.unique_number)"'

Alternatively using join:

.[]
| { ip, unique_number: .data.tls.result.handshake_log.server_certificates.certificate.parsed.unique_number }
| select(.unique_number=="123456")
| [.ip, .unique_number]
| join(", ")

Using jq to search value of a property and return another value

1 Answers1