How to replace value text in an array for specific key

[lzwaan]

I spend 2 day to get the following text replace without any luck, can anyone advise?
I tried with map_keys, map_values and for_each...

{
    "device_id": "88:AA:CC:5A:F7:90",
    "ssid_statuses": {
        "5": [
            {
                "enabled": 0,
                "ifname": "ra1",
                "ssid": "ssid_guest1"   <<< Change to "ssid": "[REDACTED]"
            },
            {
                "enabled": 0,
                "ifname": "ra2",
                "ssid": "ssid_guest2"   <<< Change to "ssid": "[REDACTED]"
            },
            {
                "enabled": 0,
                "ifname": "ra3",
                "ssid": "ssid_guest3"   <<< Change to "ssid": "[REDACTED]"
            }
        ]
    },
    "uptime":896790
}

[jszwedko]

Hi @lzwaan !

This should work for you:

.ssid_statuses =  map_values(object!(.ssid_statuses)) -> |status| { map_values(array!(status)) -> |status| { status.ssid = "[REDACTED]"; status } }

The first map_values iterates over the elements in ssid_statuses. The second map_values iterates over each element in each ssid_status.

It can be useful to use the VRL REPL (vector vrl) to develop VRL programs, if you aren't already familiar with it.

[leshow]

edit: sorry let me ask a slightly different question, why doesn't for_each work for this:

      for_each(array!(.queried_namespaces)) -> |i, val| {
        if exists(val.full_rcode) {
            val.full_rcode = "foo"
        }
      }

given input

{
 "event_type": "QUERY_RESPONSE",
 "queried_namespaces": [
     {
         "full_rcode": 0
     }
 ]
}

[jszwedko]

for_each doesn't actually return modifications. Maybe you want:

.queried_namespaces = map_values(.query_namespaces) -> |val| {
        if exists(val.full_rcode) {
            val.full_rcode = "foo"
        }
}

Note the .queried_namespaces =. That part is important as most operations in VRL are "by-value" rather than "by-reference" so mutated values are returned.

[leshow]

I see, thanks

[leshow]

BTW, that didn't really work either. it returned the result of the assignment rather than mutating, I needed

.queried_namespaces = map_values(.query_namespaces) -> |val| {
        if exists(val.full_rcode) {
            val.full_rcode = "foo"
        }
    val
}

[spencergilbert]

It looks like redact should also be usable here.

$ .
{ "device_id": "88:AA:CC:5A:F7:90", "ssid_statuses": { "5": [{ "enabled": 0, "ifname": "ra1", "ssid": "ssid_guest1" }, { "enabled": 0, "ifname": "ra2", "ssid": "ssid_guest2" }, { "enabled": 0, "ifname": "ra3", "ssid": "ssid_guest3" }] }, "uptime": 896790 }

$ redact(., filters: [r'^ssid_guest.*'])
{ "device_id": "88:AA:CC:5A:F7:90", "ssid_statuses": { "5": [{ "enabled": 0, "ifname": "ra1", "ssid": "[REDACTED]" }, { "enabled": 0, "ifname": "ra2", "ssid": "[REDACTED]" }, { "enabled": 0, "ifname": "ra3", "ssid": "[REDACTED]" }] }, "uptime": 896790 }

[lzwaan]

Thank you both, what a wonderful application it is...
It's working perfectly also in combination with encryption ;-)