-1

Having a RDAP JSON similar to this one, how do I get the abuse email address(es) (the vCardArray entry/entries with the role set to "abuse", if there is any) using jq(1)? Thank you.

P.S.: Of course I tried myself but I failed completely to get what I need from the JSON. (I am mostly used to use jq(1) only as a pretty-printer for JSON. This is the second time I try to do something more complex than just jq < ugly.json with it, because I need to parse JSON very rarely in practice.)

mjf
  • 498
  • 4
  • 15
  • pLease share your attempt! – 0stone0 Nov 29 '22 at 13:06
  • @0stone0 Do you mean my desperate trial and errors attempts? If you like to see the mess... `rdap -r 8.8.8.8 |jq 'map(select([.roles[]|contains("abuse")]|any)'` Or, later on... `rdap -r 8.8.8.8 |jq '.events | map(select(vCardArray[].roles == "abuse"))[0] | .roles'` There is not much tools for these formats like JSON, YAML etc. and are very unintuitive for old-school unixer. I had no time to learn `jq(1)`... I have to solve a real-world issue first. I will go with `sed(1)` and `awk(1)` I guess, it's single-shot action. But I wanted it to be at little more reliable, that's all... – mjf Nov 29 '22 at 13:25
  • @0stone0 I tried the step-by-step approach but didn't achieve much progress than to, in fact, always list the whole tree or somehow malformed trees. Perhaps I can use some of those tools that query JSON using SQL or I can flatten it to CSV and use ordinary unix tools to dig the information out. ? – mjf Nov 29 '22 at 13:33

1 Answers1

1
.entities[].entities[] | select(.roles | index("abuse")).vcardArray[1][] | select(.[0] == "email") | last

Will output "network-abuse@google.com" since:

  • We loop over all the .entities[].entities[]
  • Select those where .roles includes an index with the value abuse
  • Get the fields from the vcardArray: .vcardArray[1]
  • Select those where the first index .[0] matches email
  • Take the last value of that array

Try it online

0stone0
  • 34,288
  • 4
  • 39
  • 64
  • Works. And nicely explained. I learned something. I will give `jq(1)` a try some day. For now, thank you very much. – mjf Nov 29 '22 at 14:42