beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

poc JsonExtractSlice

Browse source
This commit is contained in:
Sebastien Blot 2022-04-20 09:49:32 +02:00
parent d9f111c4ca
commit 493e238455
2 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
pkg/exprhelpers/exprlib.go
View file

@ -44,6 +44,7 @@ func GetExprEnv(ctx map[string]interface{}) map[string]interface{} {
"JsonExtract": JsonExtract, "JsonExtract": JsonExtract,
"JsonExtractUnescape": JsonExtractUnescape, "JsonExtractUnescape": JsonExtractUnescape,
"JsonExtractLib": JsonExtractLib, "JsonExtractLib": JsonExtractLib,
"JsonExtractSlice": JsonExtractSlice,
"File": File, "File": File,
"RegexpInFile": RegexpInFile, "RegexpInFile": RegexpInFile,
"Upper": Upper, "Upper": Upper,

27
pkg/exprhelpers/jsonextract.go
View file

@ -1,6 +1,7 @@
package exprhelpers package exprhelpers
import ( import (
"encoding/json"
"strings" "strings"
"github.com/buger/jsonparser" "github.com/buger/jsonparser"
@ -58,3 +59,29 @@ func JsonExtract(jsblob string, target string) string {
log.Tracef("extract path %+v", fullpath) log.Tracef("extract path %+v", fullpath)
return JsonExtractLib(jsblob, fullpath...) return JsonExtractLib(jsblob, fullpath...)
} }
func JsonExtractSlice(jsblob string, target string) []interface{} {
if !strings.HasPrefix(target, "[") {
target = strings.Replace(target, "[", ".[", -1)
}
fullpath := strings.Split(target, ".")
log.Tracef("extract path %+v", fullpath)
bContent := JsonExtractLib(jsblob, fullpath...)
ret := make([]interface{}, 0)
json.Unmarshal([]byte(bContent), &ret)
return ret
}
/*func JsonExtractMap(jsblob string, target string) map[string]interface{} {
if !strings.HasPrefix(target, "[") {
target = strings.Replace(target, "[", ".[", -1)
}
fullpath := strings.Split(target, ".")
log.Tracef("extract path %+v", fullpath)
bContent := JsonExtractLib(jsblob, fullpath...)
ret := make(map[string]interface{}, 0)
json.Unmarshal([]byte(bContent), &ret)
return ret
}*/