From 7c50862d3e655e573d3c9502c86e9a67d41c124f Mon Sep 17 00:00:00 2001 From: Lowell Alleman Date: Wed, 20 Mar 2019 16:53:07 -0400 Subject: [PATCH] Minor tweaks - Switch jsonformat to use 'preserve' as the default order. - Minor comment cleanups and exception message tweaks for jmespath. --- bin/jpath.py | 13 +++++++------ bin/jsonformat.py | 2 +- default/searchbnf.conf | 9 ++++----- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/bin/jpath.py b/bin/jpath.py index 8f972eb..8b2d62c 100644 --- a/bin/jpath.py +++ b/bin/jpath.py @@ -18,7 +18,6 @@ class JmesPathSplunkExtraFunctions(functions.Functions): def _func_items(self, h): """ JMESPath includes a keys() and a values(), but with unordered objects, there's no way to line these up! So this feels like an pretty obvious extension to a Python guy! """ - #return [ [k,v] for k,v in h.items() ] return list(h.items()) @functions.signature({'types': ['array']}) @@ -45,7 +44,6 @@ def _func_from_string(self, s): unnest Can't get past the double "n"s jsonstr My first option, but don't like it. """ - # XXX: Figure out how to make this properly support (pass-through) a 'null' type if s is None: return None if isinstance(s, (list,tuple)): @@ -88,7 +86,7 @@ def _func_unroll(self, objs, key, value): continue except Exception as e: # FOR DEBUGGING ONLY - return "ERROR: Couldn't find key={} value={} in {}".format(key, value, item) + return "ERROR: {} key={} value={} in {}".format(e, key, value, item) return d @@ -125,11 +123,10 @@ def output_to_field(values, output, record): record[output] = None elif len(content) == 1: # Avoid the overhead of MV field encoding - content = content[0] + content = content[0] record[output] = content - def output_to_wildcard(values, output, record): output_template = output.replace("*", "{}", 1) if values is None: @@ -171,7 +168,7 @@ def legacy_args_fixer(options): options[n_arg] = options[o_arg] -if __name__ == '__main__': +def jpath(): try: keywords, options = si.getKeywordsAndOptions() legacy_args_fixer(options) @@ -240,3 +237,7 @@ def legacy_args_fixer(options): stack = traceback.format_exc() si.generateErrorResults("Error '%s'. %s" % (e, stack)) + + +if __name__ == '__main__': + jpath() diff --git a/bin/jsonformat.py b/bin/jsonformat.py index 16c47b6..df49675 100755 --- a/bin/jsonformat.py +++ b/bin/jsonformat.py @@ -35,7 +35,7 @@ class JsonFormatCommand(StreamingCommand): order = Option( doc="Pick order options. undefined (default), preserve, or sort. Only impacts hash order", - require=False, default="undefined", validate=validators.Set("undefined", "preserve", "sort")) + require=False, default="preserve", validate=validators.Set("undefined", "preserve", "sort")) errors = Option( doc="field name to capture any parsing error messages.", diff --git a/default/searchbnf.conf b/default/searchbnf.conf index 71f846c..4c9ccc3 100644 --- a/default/searchbnf.conf +++ b/default/searchbnf.conf @@ -66,11 +66,10 @@ tags = json [jsonformat-order-option] syntax = order=(undefined|preserve|sort) description = \ - If order is UNDEFINED, no sorting or preservation of hash order will be kept. Default because JSON says hash key \ - order is irrelevant. \ - If order is PRESERVE then the representation order is preserved in the formatted output. \ - If order is SORT then all hash keys are sorted lexicographically. This gives a more consistent result. -default = "order=undefined" + If order is UNDEFINED, no sorting or preservation of hash order will be kept. This is a bit faster. \ + If order is PRESERVE then the representation order is preserved in the formatted output. This is the default because it's what most people want. \ + If order is SORT then all hash keys are sorted lexicographically. This gives a more consistent result. +default = "order=preserve" [jsonformat-input_mode-option] syntax = input_mode=(json|python)