How to convert json events results into one json event?

[eranhauser]

My query returns many events, each event is in a form of a json i.e. { "key1": "val1", "key2":"val2"}
I would like to convert all events to one event that contains all the original events using sha256 of the original event as the key so the new json file will look like:
{

sha256a: { "key1": "val1", "key2":"val2"},
sha256b: { "key1": "val1a", "key2":"val2a"},

}

where sha256a is from | eval sha256a=sha256({ "key1": "val1", "key2":"val2"})

[eden60]

Hello,

To achieve this, you can iterate through your events, calculate the SHA256 hash for each event, and then construct a new JSON object. The resulting JSON will have SHA256 hashes as keys, each associated with the original event. Here's an example implementation in Python:

import json
import hashlib

# Your list of events in JSON format
events = [
    { "key1": "val1", "key2": "val2" },
    { "key1": "val1a", "key2": "val2a" },
    # Add more events as needed
]

# Function to calculate SHA256 hash for a given event
def calculate_sha256(event):
    event_json = json.dumps(event, sort_keys=True)
    sha256_hash = hashlib.sha256(event_json.encode()).hexdigest()
    return sha256_hash

# Construct the new JSON object with SHA256 hashes as keys
new_json = {}
for event in events:
    sha256_key = calculate_sha256(event)
    new_json[sha256_key] = event

# Print the result
print(json.dumps(new_json, indent=2))

This script defines a function (calculate_sha256) to calculate the SHA256 hash for a given event and then constructs the new JSON object (new_json) as per your requirements.

You can check this : 

https://stackoverflow.com/questions/76263284/how-to-convert-event-object-to-json/blue prism certification

I hope this will help you.

[yuanliu]

(Update) Use to_json with transpose.

| eval sha256 = sha256(_raw)
| transpose 0 header_field=sha256
| search column=_raw
| fields - column
| tojson default_type=json
| fields _raw

Your sample data thus give

_raw

{"13a485b005f3ef9af9d1e9326223f5f86d60ff1d9677d0f5e4749f91ad650227":{"key1":"val1","key2":"val2"},"b92a2ad0ea51aa55a9b298a752a6de0997c96324b3c4e74ec8d4876af490d67a":{"key1":"val1a","key2":"val2a"}}

I think this is closer to what you ask.

Another method (initial attempt): Use json_set in foreach.  Assuming the "event" you described is _raw. (Works the same if they are in a different field such as "event".  Just replace _raw with "event".)

| stats values(_raw) as event
| eval consolidated = json_object()
| foreach event mode=multivalue
    [eval consolidated = json_set(consolidated, sha256(<<ITEM>>), <<ITEM>>)]

Your sample events will give

event	consolidated
{ "key1": "val1", "key2":"val2"} { "key1": "val1a", "key2":"val2a"}	{"13a485b005f3ef9af9d1e9326223f5f86d60ff1d9677d0f5e4749f91ad650227":"{ \"key1\": \"val1\", \"key2\":\"val2\"}","b92a2ad0ea51aa55a9b298a752a6de0997c96324b3c4e74ec8d4876af490d67a":"{ \"key1\": \"val1a\", \"key2\":\"val2a\"}"}

Drawback; This produces an embedded JSON string (as opposed to a JSON object) as value of sha256.

Here is an emulation you can play with and compare with real data

| makeresults
| eval data = mvappend("{ \"key1\": \"val1\", \"key2\":\"val2\"}",
"{ \"key1\": \"val1a\", \"key2\":\"val2a\"}")
| mvexpand data
| rename data AS _raw
``` data emulation above ```

[eranhauser]

Thank you. The first solution is exactly what I wanted to achieve 

[richgalloway · Accepted solution]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[richgalloway]

What is your question?  What have you tried so far and how did those efforts not meet expectations?

Have you looked at the JSON functions in the Search Reference Manual?

[fredclown]

"where sha256a is from | eval sha256a=sha256({ "key1": "val1", "key2":"val2"})"

What are you saying in the above statement? Do you want the events to be sha256 encoded? That's not what you put in you example so that part is a bit confusing. The first event in your combined json starts with sha256a and the second sha256b. Should the next be sha256c? Please post example events and an example of what you would like them transformed into.