I have some json conforming to XDAS-v2 and, unfortunately, the spath command cannot make much sense of it. Is there a easy way to use this kind of json that I overlooked?
I tried to do some of it with props.conf:
[xdas-events]
KV_MODE = JSON
INDEXED_EXTRACTIONS = JSON
pulldown_type=1
Sample event:
Jun 18 12:28:31 IDM : INFO {"Source" : "IDM","Observer" : {"Entity" : {"SysName" : "chhs-sidm017"}},"Initiator" : {"Entity" : {"SvcName" : "CN=INTG2,OU=SYSTEM,O=SOME","SvcComp" : "\\Driver"}},"Target" : {"Data" : {"DATA" : "<status level=\"success\" type=\"driver-status\">Driver state changed to Running.<application>DirXML</application>\n\t<module>WORKER</module>\n\t<object-dn></object-dn>\n\t<component>Subscriber</component>\n</status>","MIME_HINT" : "3","ORIGINATOR_TYPE" : "1","TARGET_TYPE" : "1","TEXT3" : "Driver state changed to Running.","VALUE1" : "2","VALUE2" : "0","VALUE3" : "0"},"Entity" : {"SvcName" : "CN=WORKER,CN=IDM-INTG,OU=IDM,OU=SYSTEM,O=SOME","SvcComp" : "DirXML-State"}},"Action" : {"Event" : {"Id" : "0.0.3.5","Name" : "Enable Service","SubEvent" : "30022"},"Time" : {"Offset" : 1434623311},"Log" : {"Severity" : 7}}}
The schema of the content is as follows:
{
"id":"XDASv2",
"title":"XDAS Version 2 JSON Schema",
"description":"A JSON representation of an XDASv2 event record.",
"type":"objectr",
"properties":{
"Source":{
"description":"The original source of the event, if applicable.",
"type":"string",
"optional":true
},
"Observer":{
"description":"The recorder (ie., the XDASv2 service) of the event.",
"type":"object",
"optional":false,
"properties":{
"Account":{"$ref":"account"},
"Entity":{"$ref":"entity"}
}
},
"Initiator":{
"description":"The authenticated entity or access token that causes an event.",
"type":"object",
"optional":false,
"properties":{
"Account":{"$ref":"account","optional":true},
"Entity":{"$ref":"entity"},
"Assertions":{
"description":"Attribute/value assertions about an identity.",
"type":"object",
"optional":true
}
}
},
"Target":{
"description":"The target object, account, data item, etc of the event.",
"type":"object",
"optional":true,
"properties":{
"Account":{"$ref":"account"},
"Entity":{"$ref":"entity"},
"Data":{
"description":"A set attribute/value pairs describing the target object.", *
"type":"object",
"optional":true
}
}
},
"Action":{
"description":"The action describes the event in a uniform manner.",
"type":"object",
"optional":false,
"properties":{
"Event":{
"description":"The event identifier in standard XDASv2 taxonomy.",
"type":"object",
"optional":false,
"properties":{
"Id":{
"description":"The XDASv2 taxonomy event identifier.",
"type":"string",
"optional":false,
"pattern":"/^[0-9]+(\.[0-9]+)*$/"
},
"Name":{
"description":"A short descriptive name for the specific event.", eg. a new replica is added
"type":"string",
"optional":true
},
"CorrelationID":{
"description":"Correlation ID, source#uniqueID#connID",
"type":"string",
"optional":true
}
},
"SubEvent":{
"type":object
"description": "Describes the actual domain specific event that has occured.",
"optional":true,
"properties":{
"Name"":{
"description":"A short descriptive name for this event.",
"type":"string",
"optional":true
},
}
}
}
"Log":{
"description":"Client-specified logging attributes.",
"optional":true,
"properties":{
"Severity":{"type":"integer", "optional":true},
"Priority":{"type":"integer", "optional":true},
"Facility":{"type":"integer", "optional":true}
}
}
"Outcome":{
"description":"The XDASv2 taxonomy outcome identifier.",
"type":"string",
"optional":false,
"pattern":"/^[0-9]+(\.[0-9]+)*$/"
}
"Time":{
"description":"The time the event occurred.",
"type":"object",
"optional":false,
"properties":{
"Offset":{
"description":"Seconds since Jan 1, 1970.",
"type":"integer"
},
"Sequence":{
"description":"Milliseconds since last integral second.",
"type":"integer",
"optional":true
},
"Tolerance":{
"description":"A tolerance value in milliseconds.",
"type":"integer",
"optional":true
},
"Certainty":{
"description":"Percentage certainty of tolerance.",
"type":"integer",
"optional":true,
"minimum":0,
"maximum":100,
"default":100,
},
"Source":{
"description":"The time source (eg., ntp://time.nist.gov).",
"type":"string",
"optional":true
},
"Zone":{
"description":"A valid timezone symbol (eg., MST/MDT).",
"type":"string",
"optional":true
}
}
"ExtendedOutcome":{
"description":"The XDASv2 taxonomy outcome identifier.",
"type":"string",
"optional":false,
"pattern":"/^[0-9]+(\.[0-9]+)*$/"
}
}
}
}
},
{
"id":"account",
"description":"A representation of an XDAS account.",
"type":"object",
"properties":{
"Domain":{
"description":"A (URL) reference to the authority managing this account.", /* lets take it as the partition?
"type":"string"
},
"Name":{
"description":"A human-readable account name.", - DN
"type":"string",
"optional":true
},
"Id":{
"description":"A machine-readable unique account identifier value.", - EntryID
"type":"integer"
}
}
},
{
"id":"entity", - Server details for Target, client address details for the initiator
"description":"A representation of an addressable entity.",
"type":"object",
"properties":{
"SysAddr":{"type":"string","optional":true},
"SysName":{"type":"string","optional":true},
"SvcName":{"type":"string","optional":true},
"SvcComp":{"type":"string","optional":true},
}
}
... View more
