Flat JSON

Most recent version: v1.1.0

See the changelog of this Action type here.

Overview

The Flat JSON Action converts a nested JSON into a new, flattened JSON field with only one layer of key/value pairs.

In order to configure this action, you must first link it to a Listener. Go to Building a Pipeline to learn how to link.

Ports

These are the input and output ports of this Action:

Input ports

• Default port - All the events to be processed by this Action enter through this port.

Output ports

• Default port - Events are sent through this port if no error occurs while processing them.

• Error port - Events are sent through this port if an error occurs while processing them.

Configuration

1

Find Flat JSON in the Actions tab (under the Transformation group) and drag it onto the canvas.

2

To open the configuration, click the Action in the canvas and select Configuration.

3

Enter the required parameters:

Parameter	Description
Field that holds the JSON*	Select the field that contains the JSON values from the incoming data.
Field where the flatten JSON will be stored*	Give a name to the field that will store the flattened JSON values.
Flatten level	Set the number of levels to flatten to.
Separator	Choose to separate values with _ or . (_ by default).

4

Click Save to complete the process.

Example

You wish to flatten a JSON to level 3 hierarchy.

1

Raw JSON

Your input data contains the following raw JSON file:

[
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "breach log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on breach log",
    "viewport": [1920, 955],
    "usage": true
  },
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "event log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on event log from breach log",
    "viewport": [1920, 955],
    "usage": true
  },
  {
    "username": "service_user",
    "method": "POST",
    "endpoint": "/admin/age",
    "ip": "127.0.0.1",
    "status": 400
  },
  {
    "username": "user_2",
    "method": "POST",
    "endpoint": "/sso/login",
    "ip": "10.XXX.XX.XX",
    "status": 302
  }
]

You can add a Parser and paste this data as raw data to generate the event.

2

Flat JSON

Add the Flat JSON Action to the canvas and enter the following:

• Field that holds the JSON - msg

• Field where the flatten JSON will be stored - give your new field a name e.g. Flattened

• Flatten level - 3

3

Results

The Flat JSON Action now has an output field that will send the JSON flattened to a level 3 hierarchy:

[
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "breach log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on breach log",
    "usage": true,
    "viewport_dimensions": {
      "width": 1920,
      "height": 955
    }
  },
  {
    "username": "user_1",
    "method": "POST",
    "endpoint": "event log",
    "ip": "10.XXX.XX.XX",
    "description": "[Role] User performed an action on event log from breach log",
    "usage": true,
    "viewport_dimensions": {
      "width": 1920,
      "height": 955
    }
  },
  {
    "username": "service_user",
    "method": "POST",
    "endpoint": "/admin/age",
    "ip": "127.0.0.1",
    "status": 400
  },
  {
    "username": "user_2",
    "method": "POST",
    "endpoint": "/sso/login",
    "ip": "10.XXX.XX.XX",
    "status": 302
  }
]