5

What am I trying to do?

Given a file of json events. I want to locate specific events by keyword and then replace the value of key in that event with "". This must be done with sed (Splunk forwarding issue.. I wont bore you with the details).

Example Event

{
  "message":"we have a response from SomeService",
  "other":"some stuff",
  "other2":"some other stuff",
  "xml":"<Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:awsse=\"http://xml.chicken.com/2010/06/Session_v3\" xmlns:wsa=\"http://www.w3.org/2005/08/addressing\"><Header><To>http://www.w3.org/2005/08/addressing/anonymous</To><From><Address>..... AND SO ON BIG GIANT NASTEY XML",
  "other3":"even more stuff"
}

Desired outcome

{
  "message":"we have a response from SomeService",
  "other":"some stuff",
  "other2":"some other stuff",
  "xml":"",
  "other3":"even more stuff"
}

What have I tried? I can isolate the events and replace a key no problem. I am struggling with a regex to replace the value of a key in the json. 

cat test.json | sed '/"we have a response from SomeService"/ s/other2/chicken/'

Thansk for you help!

mconlin
  • 8,169
  • 5
  • 31
  • 37
  • No, they are not. The whole json event is one line. – mconlin Aug 02 '17 at 15:01
  • 1
    json is the same type of grammar as html, and we all know how well [that works](https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags) – Austin_Anderson Aug 02 '17 at 16:10
  • `s/other2":"[^"]*",/other2":"newValue",/` ?? With everything on one line the greedy `.*` is going to burn you, so use `[^"]*` which means any number of non-doublequote chars. – stevesliva Aug 02 '17 at 17:32
  • 1
    You might try this `cat test.json | sed '/"xml":/ s/"xml":[^,]*/"xml":""/'` :) – Paul Aug 03 '17 at 13:24
  • Paul - this works great do you want to post it as an answer so I can green check mark it? – mconlin Aug 03 '17 at 15:05

1 Answers1

6

copy from comment

You might try this

cat test.json | sed '/"xml":/ s/"xml":[^,]*/"xml":""/'

[^,]* will match everything until , being find.

Paul
  • 1,630
  • 1
  • 16
  • 23