LogoLogo
WebsiteBlogLogin
  • Onum Docs
  • Use Cases
  • Videos
  • Release Notes
  • Welcome
  • Getting Started
    • About Onum
    • Architecture
    • Deployment
    • Getting Started with Onum
    • Understanding The Essentials
      • Cards and Table Views
      • Data Types
      • Graph Calculations
      • The Time Range Selector
    • Key Terminology
  • THE WORKSPACE
    • Home
    • Listeners
      • Cloud Listeners
      • Listener Integrations
        • Amazon SQS
        • Amazon S3
        • Apache Kafka
        • Azure Event Hubs
        • Cisco NetFlow
        • Google Pub/Sub
        • HTTP
        • HTTP Pull
        • Microsoft 365
        • OpenTelemetry
        • Syslog
        • TCP
      • Labels
    • Pipelines
      • Building a Pipeline
        • AI Assistant
          • AI Pipeline Assistant
          • AI Action Assistant
      • Listeners
      • Actions
        • Advanced
          • Anonymizer
          • Bring Your Own Code
          • Field Generator
          • For Each
          • Google DLP
          • HTTP Request
          • Redis
        • Aggregation
          • Accumulator
          • Group By
        • AI
          • Amazon GenAI
          • BLIP-2
          • Cog
          • Google GenAI
          • Llama
          • Replicate
        • Detection
          • Sigma Rules
        • Enrichment
          • Lookup
        • Filtering
          • Conditional
          • Sampling
        • Formatting
          • Message Builder
        • Transformation
          • Field Transformation
            • Field Transformation Operations
              • Arithmetic / Logic
                • Divide Operation
                • Median
                • Multiply Operation
                • Subtract Operation
                • Sum Operation
              • Code tidy
                • JSON Minify
              • Control characters
                • Escape String
                • Unescape String
              • Conversion
                • Convert Area
                • Convert Data Units
                • Convert Distance
                • Convert Mass
                • Convert Speed
                • List to String
                • String to List
              • Data format
                • From Base
                • From Base64
                • From Hex
                • To Base
                • To Base64
                • To Hex
              • Date / Time
                • From Unix Timestamp
                • To Timestamp
                • To Unix Timestamp
                • Translate Datetime Format
              • Encoding / Decoding
                • From Binary
                • To Binary
                • To Decimal
              • Encryption / Encoding
                • JWT Decode
              • File system permissions
                • Parse Unix file permissions
              • Format conversion
                • CSV to JSON
                • JSON to CSV
              • Hashing
                • Keccak
                • MD2
                • MD4
                • MD5
                • SHA0
                • SHA1
                • SHA2
                • SHA3
                • Shake
                • SM3
              • Networking
                • Defang IP Address
                • Defang URL
                • Extract IP Address
                • Fang IP Address
                • Fang URLs
                • IP to Hexadecimal
                • Parse URI
                • URL Decode
                • URL Encode
              • Other
                • Parse Int
              • String
                • Length
              • Text sample adding
                • Pad Lines
              • Utils
                • Byte to Human Readable
                • Count Occurrences
                • CRC8 Checksum
                • CRC16 Checksum
                • CRC24 Checksum
                • CRC32 Checksum
                • Credit Card Obfuscator
                • Filter
                • Find and Replace
                • Regex
                • Remove Whitespace
                • Reverse String
                • Shuffle
                • Sort
                • Substring
                • Swap Case
                • To Lower Case
                • To Upper Case
          • Flat JSON
          • JSON Transformation
          • JSON Unroll
          • Math Expression
          • Parser
            • PCL (Parser Configuration Language)
        • Utils
          • Unique
      • Data sinks
      • Bulk Changes
      • Publishing & Versioning
      • Test your Pipeline
    • Data sinks
      • Data sink Integrations
        • Amazon S3
        • Amazon SQS
        • Azure Blob Storage
        • Azure Event Hubs
        • Devo
        • Google BigQuery
        • Google Cloud Storage
        • Google Pub/Sub
        • HTTP
        • Jira
        • Mail
        • Null
        • OpenTelemetry
        • PagerDuty
        • Pushover
        • Qradar
        • Relational Databases
        • ServiceNow
        • Slack
        • Splunk HEC
        • Syslog
        • TCP
        • Telegram
        • Twilio
    • Alerts
  • YOUR VAULT
    • Enrichment
    • Data History
    • Actions
  • ADMINISTRATION
    • Tenant Menu
    • Global Settings
      • Your Account
      • Organization Settings
        • Secrets Management
      • Tenant
        • Authentication
        • Users
        • Activity Log
  • MARKETPLACE
    • Onum Marketplace
      • Pulling Pipelines
        • Netskope Events Alert
        • OKTA System Log API
        • Sophos Connector SIEM
Powered by GitBook
On this page
  • Overview
  • Ports
  • Configuration
  • Examples

Was this helpful?

Export as PDF
  1. THE WORKSPACE
  2. Pipelines
  3. Actions
  4. Transformation

JSON Transformation

Most recent version: v0.0.1

PreviousFlat JSONNextJSON Unroll

Last updated 4 days ago

Was this helpful?

See the changelog of this Action type .

Overview

The JSON Transformation Action modifies your input JSON values using one of the given operations.

Ports

These are the input and output ports of this Action:

Input ports
  • Default port - All the events to be processed by this Action enter through this port.

Output ports
  • Default port - Events are sent through this port if no error occurs while processing them.

  • Error port - Events are sent through this port if an error occurs while processing them.

Configuration

1

Find JSON Transformation in the Actions tab (under the Transformation group) and drag it onto the canvas.

2

To open the configuration, click the Action in the canvas and select Configuration.

3

Enter the required parameters:

Parameter
Description

Select field to transform*

Select the field containing the JSON values from the incoming data. A sample input JSON is in the code box below.

Select operation*

Select the operation to perform on your JSON field:

  • JQ - Performs a jq query on your input JSON values. Enter the following:

    • Query Expression* - Enter the required jq expression. Note that the jq syntax has some limitations when you use it in this operation. Learn more in the note below.

  • Flat JSON - Converts a nested JSON into a new, flattened JSON field with only one layer of key/value pairs. Enter the following:

    • Flatten level* - Set the maximum number of levels to flatten to.

    • Choose an option - Choose to separate values with _ or . (_ by default.

Output field*

Give your output field a name. You will ssee the transformation of the sample input JSON after applying the selected operation in the box below.

4

Click Save to complete the process.

JQ syntax limitations

Note that the JQ language has some limitations in Onum:

  • The following jq operations are not supported: get_jq_origin, get_prog_origin, get_search_list , input_line_number and $__loc__

  • The following jq flags are not supported: --ascii-output, -a, --seq, --sort-keys, -S and --unbuffered

  • JSON extensions cannot be parsed (NaN, Infinity and [000]).

  • Some regular expression metacharacters, back references, and look-around assertions are not supported.

  • Byte-order mark (BOM) is not supported.

  • Keywords cannot be used as function names.

  • Module name prefixes cannot be used in function declarations.

Examples

Check below an example with the different JSON operations available:

JQ

Suppose you want to apply a specific jq query to the JSON values in your input events. In this case, we need to get only the names from the values in our JSONs.

Raw JSON

Your input data contains the following raw JSON file in the msg field:

[
   {
      "name":"Alice",
      "age":30
   },
   {
      "name":"Bob",
      "age":25
   },
   {
      "name":"Carol",
      "age":35
   }
]

Flat JSON

Add the JSON Transformation Action to the canvas and enter the following:

  • Field to transform - msg

  • Select operation - JQ

    • Query expression - jq '.[].name'

  • Out field - JQvalue

Results

The output field JQvalue will return the results after applying the specified JQ query:

[
   "Alice",
   "Bob",
   "Carol"
]
Flat JSON

Suppose you wish to flatten a JSON value in your input events.

Raw JSON

Your input data contains the following raw JSON file in the msg field:

{
   "name":John,
   "age":30,
   "address":{
      "street":"123 Main St",
      "city":"Anytown",
      "country":"USA"
   },
   "contacts":[
      {
         "type":"email",
         "value":"john.doe@example.com"
      },
      {
         "type":"phone",
         "value":"555-1234"
      }
   ]
}

Flat JSON

Add the JSON Transformation Action to the canvas and enter the following:

  • Field to transform - msg

  • Select operation - FlatJSON

    • Flatten level - 5

    • Separator - .

  • Out field - Flattened

Results

The output field Flattened will return the JSON value flattened to a maximum level-5 hierarchy:

{
   "name":John,
   "age":30,
   "address.street":"123 Main St",
   "address.city":"Anytown",
   "address.country":"USA",
   "contacts[0].type":"email",
   "contacts[0].value":"john.doe@example.com",
   "contacts[1].type":"phone",
   "contacts[1].value":"555-1234"
}

In order to configure this Action, you must first link it to a Listener. Go to to learn how to link.

Building a Pipeline
here