ElasticSearch api parse nested string json dashboard

Question

I am using ElasticSearch GET to get the json file of a dashbaord: for example: http://ES_IP:9200/kibana-int/dashboard/my_Dashboard/

This returns me a json file like:

{"_index":"kibana-int","_type":"dashboard","_id":"my_Dashboard","_version":5,"found":true,"_source":{ "user":"guest", "group":"guest", "title":"my_Dashboard", "dashboard":"{ \"title\": \"My Dashboard\", \"services\": { \"query\": { \"list\": { \"0\": { \"id\": 0, \"type\": \"lucene\", \"query\": \"type:dh AND severity:ERROR AND (response.baseUrl:\"/rm/recordings/*\" OR request.baseUrl:\"/rm/recordings/*\")\", \"alias\": \"DH errors rcc\",.......

Here is where I need your help, how can I get the value of the key "dashboard" but without the escaped '\' character in the key/val pair not affecting the escaped that are part of the values?

The output that I need should be something like:

{ "title": "My Dashboard", "services": { "query": { "list": { "0": { "id": 0, "type": "lucene", "query": "type:dh AND severity:ERROR AND (response.baseUrl:\"/rm/recordings/*\" OR request.baseUrl:\"/rm/recordings/*\")", "alias": "DH errors rcc",.......

Pay attention in the query key, in its value, there are some \" that shouldn't be affected, since they are part of the value.

I need that output to then parse that json with jq in a some bash script I have.

Does ElasticSearch api have some filter to provide me that output? Or do you know another external method to get what I need?

Thanks a lot for the help.

score 0 · Answer 1 · answered Aug 23 '15 at 17:11

0

fromjson is your friend. For example:

def data: {
  "_index": "kibana-int",
  "_type": "dashboard",
  "_id": "my_Dashboard",
  "_version": 5,
  "found": true,
  "_source": {
    "user": "guest",
    "group": "guest",
    "title": "my_Dashboard",
    "dashboard": "{ \"title\": \"My Dashboard\", \"services\": { \"query\": { \"list\": { \"0\": \"foobar\" }}}}"
  }
};

data | ._source.dashboard | fromjson

Output:

$ jq -n -f elastic.jq
{
  "title": "My Dashboard",
  "services": {
    "query": {
      "list": {
        "0": "foobar"
      }
    }
  }
}

answered Aug 23 '15 at 17:11

peak

105,803
17
152
177

Thanks for the answer, but the problem is in the key "query", you can see it in my example, part of its value has escaped \" that shouldn't be modified because is part of the value: \"/rm/recordings/*\" shouldn't be modified. The jq command fromjson, fails due to that problem, because it converts it as "/rm/recordings/*" and that shouldn't happen for that case. Any other idea? Thanks a lot for the help. – user2620348 Aug 24 '15 at 01:07
(1) http://ES_IP:9200/kibana-int/dashboard/my_Dashboard/ returns ERR_NAME_NOT_RESOLVED; (2) Your example JSON is truncated. (3) Is your point that ES is returning a JSON string that is in some sense incorrect? If so, could you explicate what the "correct" JSON should be? – peak Aug 24 '15 at 01:16

ElasticSearch api parse nested string json dashboard

1 Answers1