-
Notifications
You must be signed in to change notification settings - Fork 64
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Question] Alter JSON output #208
Comments
I would probably use It can also handle streams if that's an issue https://stackoverflow.com/questions/62825963/improving-performance-when-using-jq-to-process-large-files. |
Preferably I want to have it baked into the code. Not sure where to start. Running into problems with option (2): apparently renaming fields is not trivial. Replacing values is quite easy with:
|
@OlafHaalstra , you will want to create a custom tool around the let mut evtx_parser = match EvtxParser::from_path(path) {
Ok(p) => p.with_configuration(parser_settings),
Err(e) => {
eprintln!("Error handling {}; {}", path.display(), e);
return;
}
};
for result in evtx_parser.records_json_value() {
let record = match result {
Ok(r) => r,
Err(e) => {
eprintln!("Error serializing event record: {}", e);
continue;
}
};
let mut json_value = record.data;
json_value["source_file"] = json!(path.to_string_lossy());
println!("{}", json_value);
} I am actually planning to make a YouTube video this week that will showcase just this along with things like recursing and parsing files in parallel. Subscribe and hit the bell so it will alert you when this video comes out (https://www.youtube.com/channel/UCudIWnSPimNaqMyGoKbaneQ) |
Baking this into the library is not a good idea. Its better to augment data after you have parsed the raw data as this is personal preference on how you want to structure metadata around the parsed entry. |
@OlafHaalstra I made a video that I think will answer your question on how to do this and also give you an example of how to create a CLI around this library and tweak the json values. https://www.youtube.com/watch?v=yVeCAMQ5fZo |
Dear Omer,
Awesome work on this library, it is really blazing fast.
I hope you can help me with the following question about the JSON serializer. I would like to alter the JSON data that is outputted by the parser and I am looking for the best way to do it.
By default it outputs something like this:
Which I would like to append a few properties to, e.g.:
This should happen somewhere around this snippet of code, which returns a
record
which contains the data object which is already a string (from theinto_json
function):The following solutions were the ones I could think off:
fields
part.record.data
string
to object withserde_json
, alter it, and convert it tostring
again.records_json
functioninsert even better solution here
I'm asking for your advise on this because I wasn't able to figure it out how to properly do it in rust, also performance is important for me so I want to find a very efficient solution.
For solution (3) I already tried to implement something but that doesn't work. Maybe you can provide some guidance or you might even have a much better solution in mind.
The text was updated successfully, but these errors were encountered: