Jolt specification in apache nifi

Question

input:

{
  "eventid": "165",
  "name": "High memory utilization",
  "severity": "0",
  "userid": "1",
  "hosts": [
    {
      "hostid": "101",
      "proxy_hostid": "0",
      "host": "hostname",
      "name": "name"
    }
  ],
  "relatedObject": {
    "description": "High memory utilization",
    "comments": "The system is running out of free memory.",
    "uuid": ""
  },
  "tags": [
    {
      "tag": "component",
      "value": "memory"
    },
    {
      "tag": "class",
      "value": "os"
    },
    {
      "tag": "target",
      "value": "linux"
    }
  ]
}

Expected output

{
  "severity" : "0",
  "name" : "High memory utilization",
  "host" : "hostname",
  "parameter" : "memory"
}

The tag component value should be assigned to parameter field. Please help me out.

Answer 1

Walk through the objects of the array as you want to get the value of the value key from the object, which is a member of tags array, having tag key with value which is equal to component after making tag value the key names of each of their nesting objects.

Then derive the values from the outer attributes by using these shift transformation specs

[
  {
    // tag objects with the value of the tag keys
    "operation": "shift",
    "spec": {
      "tags": {
        "*": {
          "@(2,severity)": "@(1,tag).severity", // go two levels up to grab the value from the attribute "severity"
          "@(2,name)": "@(1,tag).name",
          "@(2,hosts[0].host)": "@(1,tag).host", // go two levels up to grab the value from the array "hosts" and pick the first objects's "host" value among the objects nested within the array
          "value": "@(1,tag).&"
        }
      }
    }
  },
  {
    // pick only the key-value pair from the object which's tagged "component"
    "operation": "shift",
    "spec": {
      "component": ""
    }
  },
  {
    // replace the tag name of the attribute with "parameter"
    "operation": "shift",
    "spec": {
      "*": "&", // "else" case (matches the attributes other than the below one)
      "value": "parameter" // rename the attribute "value" to "parameter"
    }
  }
]