在 Python 中将嵌套的 JSON 数组转换为简单的 JSON

Question

我有一个带有嵌套 JSON 对象的 JSON 文件。我想通过 Logstash 将此 JSON 文件索引到我的 Elasticsearch 中，但 Elasticsearch 还不支持嵌套 JSON。 python中有没有办法将这些嵌套对象转换为简单的JSON，即可搜索？

我使用的 JSON 是由使用 Nmap 并确定网络上的主机的 python 脚本创建的。目前无法搜索端口数组，这是我项目的全部目的。这是因为 JSON 数组被索引为数据库中的一个字段，而不是它们自己的 JSON 字段。

示例：

{
    "host": {
        "status": {
            "_state": "up",
            "_reason": "echo-reply",
            "_reason_ttl": "60"
        },
        "address": {
            "_addr": "xxx.xxx.xxx.xxx",
            "_addrtype": "ipv4"
        },
        "hostnames": {
            "hostname": {
                "_name": "xxxxxx.com",
                "_type": "PTR"
            }
        },
        "ports": {
            "extraports": {
                "extrareasons": {
                    "_reason": "no-responses",
                    "_count": "994"
                },
                "_state": "filtered",
                "_count": "994"
            },
            "port": [
                {
                    "state": {
                        "_state": "closed",
                        "_reason": "reset",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "_name": "ftp-data",
                        "_method": "table",
                        "_conf": "3"
                    },
                    "_protocol": "tcp",
                    "_portid": "20"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:vsftpd:vsftpd",
                        "_name": "ftp",
                        "_product": "vsftpd",
                        "_version": "2.0.8 or later",
                        "_hostname": "Welcome",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "21"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:openbsd:openssh:5.3",
                        "_name": "ssh",
                        "_product": "OpenSSH",
                        "_version": "5.3",
                        "_extrainfo": "protocol 2.0",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "22"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:apache:http_server:2.2.15",
                        "_name": "http",
                        "_product": "Apache httpd",
                        "_version": "2.2.15",
                        "_extrainfo": "(CentOS)",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "80"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:apache:http_server:2.2.15",
                        "_name": "http",
                        "_product": "Apache httpd",
                        "_version": "2.2.15",
                        "_extrainfo": "(CentOS)",
                        "_tunnel": "ssl",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "443"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "_name": "rsync",
                        "_extrainfo": "protocol version 31",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "873"
                }
            ]
        },
        "times": {
            "_srtt": "1392",
            "_rttvar": "258",
            "_to": "50000"
        },
        "_starttime": "1527320392",
        "_endtime": "1527320668"
    }
}

Answer 1

不要在 elasticsearch 映射中使用嵌套关键字

您可以做的更好的方法是将整个 json 结构定义为映射

然后在elasticsearch中搜索你可能会得到它。