Flat JSON

Most recent version: v1.1.0

See the changelog of this Action type here.

Deprecated operation

This operation has been deprecated and is no longer supported. We recommend using the JSON Transformation operation as its replacement.

Overview

The Flat JSON Action converts a nested JSON into a new, flattened JSON field with only one layer of key/value pairs.

In order to configure this action, you must first link it to a Listener. Go to Building a Pipeline to learn how to link.

Ports

These are the input and output ports of this Action:

Input ports

• Default port - All the events to be processed by this Action enter through this port.

Output ports

• Default port - Events are sent through this port if no error occurs while processing them.

• Error port - Events are sent through this port if an error occurs while processing them.

Configuration

1

Find Flat JSON in the Actions tab (under the Transformation group) and drag it onto the canvas.

2

To open the configuration, click the Action in the canvas and select Configuration.

3

Enter the required parameters:

Parameter	Description
Field that holds the JSON*	Select the field that contains the JSON values from the incoming data.
Field where the flatten JSON will be stored*	Give a name to the field that will store the flattened JSON values.
Flatten level	Set the number of levels to flatten to.
Separator	Choose to separate values with _ or . (_ by default).

4

Click Save to complete the process.

Example

You wish to flatten a JSON to level 3 hierarchy.

1

Raw JSON

Your input data contains the following raw JSON file:

[
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "breach log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on breach log",
    "viewport": [1920, 955],
    "usage": true
  },
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "event log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on event log from breach log",
    "viewport": [1920, 955],
    "usage": true
  },
  {
    "username": "service_user",
    "method": "POST",
    "endpoint": "/admin/age",
    "ip": "127.0.0.1",
    "status": 400
  },
  {
    "username": "user_2",
    "method": "POST",
    "endpoint": "/sso/login",
    "ip": "10.XXX.XX.XX",
    "status": 302
  }
]

You can add a Parser and paste this data as raw data to generate the event.

2

Flat JSON

Add the Flat JSON Action to the canvas and enter the following:

• Field that holds the JSON - msg

• Field where the flatten JSON will be stored - give your new field a name e.g. Flattened

• Flatten level - 3

3

Results

The Flat JSON Action now has an output field that will send the JSON flattened to a level 3 hierarchy:

[
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "breach log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on breach log",
    "usage": true,
    "viewport_dimensions": {
      "width": 1920,
      "height": 955
    }
  },
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "event log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on event log from breach log",
    "usage": true,
    "viewport_dimensions": {
      "width": 1920,
      "height": 955
    }
  },
  {
    "username": "service_user",
    "method": "POST",
    "endpoint": "/admin/age",
    "ip": "127.0.0.1",
    "status": 400
  },
  {
    "username": "user_2",
    "method": "POST",
    "endpoint": "/sso/login",
    "ip": "10.XXX.XX.XX",
    "status": 302
  }
]