Solved: Extract nested key value pairs json - Page 2

Aswin_Asokan · 12-08-2024 03:01 AM

I'm trying to extract ip and hostname from a nested json. There are multiple ips and hostnames depending on the alert category. How can we extract and assign all the IPs and hostnames it to target.ip and target.hostname?

{
"target": {
    "total_count": 2,
    "data": [
      {
        "device": [
          {
            "value": "10.10.10.10",
            "type": "ip"
          },
          {
            "value": "abc",
            "type": "hostname"
          }
        ],
        "type": "endpoint",
      },
      {
        "device": [
          {
            "value": "11.11.11.11",
            "type": "ip"
          },
          {
            "value": "z44",
            "type": "hostname"
          }
        ],
"type": "endpoint",
}
],
}

}

Parser syntax documentation doesn't have references for this type of nested json data where key value pairs are separated.

AbdElHafez

@Aswin_Asokan In that case the security_result field is probably more suitable.

Please try this version ;

filter {
    json {   source => "message"   array_function => "split_columns" }

mutate {replace => {"ipDedupRegex" => " "}}
mutate {replace => {"hostDedupRegex" => " "}}
mutate {replace => {"event1.idm.read_only_udm.metadata.event_type" => "GENERIC_EVENT"}}
mutate {replace => {"event1.idm.read_only_udm.metadata.vendor_name" => "Cisco"}}
mutate {replace => {"event1.idm.read_only_udm.metadata.product_name" => "XDR"}}

for k,v in target.data map {
    for k2,v2 in v.device map {
        if [v2][type] == "ip" {
            if [v2][value] !~ ipDedupRegex {
                if k=="0" {
                    mutate {replace => {"ipDedupRegex" => "%{v2.value}"}}
                    }
                else {
                    mutate {replace => {"ipDedupRegex" => "%{ipDedupRegex}|%{v2.value}"}}
                    }
            mutate {merge => {"ipList_" => "v2.value"}}
            }

            mutate {replace => {"ip_" => "%{v2.value}"}}
            mutate {merge => {"security_result_.about.ip" => "ip_"}}
            #mutate {rename => {"ip_list" => "zz"}}
            #statedump {}
        }
       else if  [v2][type] == "hostname" {
            if [v2][value] !~ hostDedupRegex {
                if k=="0" {
                    mutate {replace => {"hostDedupRegex" => "%{v2.value}"}}
                    }
                else {
                    mutate {replace => {"hostDedupRegex" => "%{hostDedupRegex}|%{v2.value}"}}
                    }
            mutate {merge => {"hostList_" => "v2.value"}}
            }
            mutate {replace => {"security_result_.about.hostname" => "%{v2.value}"}}
            #mutate {rename => {"host_" => "about_.hostname"}}
            #statedump {}
        }

    #mutate {rename => {"about" => "x.about"}}
    #mutate {merge => {"about_" => "about"}}
    #mutate {rename => {"about_" => "x.about_"}}
    }
    #mutate {rename => {"about" => "x"}}
    mutate {merge => {"event1.idm.read_only_udm.security_result" => "security_result_"}}
    #mutate {rename => {"security_result" => "event1.idm.read_only_udm.security_result"}}
    mutate {replace => {"security_result_" => ""}}
    #mutate {replace => {"about_" => "about"}}

}
    #mutate {merge => {"about_" => "about"}}
statedump {}
mutate {
  merge => {
    "@output" => "event1"
 }
}

#SecurityResult
}

I left some unused tokens "hostList_" and "ipList_" in case you needed them separate.

View solution in original post

Webinar May 29th: Log Ingestion: Bindplane + Google SecOps

Extract nested key value pairs json