How can I duplicate an array based on an internal array using jq?

Question

I've managed to chop down the initial file into a final array that I want, but I'm uncertain on how to manipulate it. I have a clear before and desired "after";

Before:

[
  "Access Token Manipulation",
  "T1134",
  [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "defense-evasion"
    },
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "privilege-escalation"
    }
  ]
]

After:

[
  "Access Token Manipulation",
  "T1134",
  "defense-evasion"
]
[
  "Access Token Manipulation",
  "T1134",
  "privilege-escalation"
]

I'll convert this with @csv afterwards, but the objects need to be split up first. Part of me thinks that recurse or a foreach works, but another part of me thinks that this is just so simple and I'm looking over something.

choroba · Accepted Answer · 2021-02-19 17:29:14Z

2

Remember the first two elements in a variable, extract the phase name and add it to the variable:

jq '[.[0],.[1]] as $h | .[2][].phase_name | $h + [.]'

answered Feb 19, 2021 at 17:29

choroba

245k27 gold badges221 silver badges304 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How can I duplicate an array based on an internal array using jq?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related