从数组中删除jq条件

Question

我从aws得到了这个json，这只是我创建的一个测试，而不是我的实际规则

[
    {
      "Name": "Fortinet-all_rules",
      "Priority": 0,
      "Statement": {
        "ManagedRuleGroupStatement": {
          "VendorName": "Fortinet",
          "Name": "all_rules",
          "ExcludedRules": [
            {
              "Name": "Database-Vulnerability-Exploit-01"
            },
            {
              "Name": "Database-Vulnerability-Exploit-02"
            },
            {
              "Name": "Database-Vulnerability-Exploit-03"
            },
            {
              "Name": "Malicious-Robot"
            },
            {
              "Name": "OS-Command-Injection-01"
            },
            {
              "Name": "OS-Command-Injection-02"
            },
            {
              "Name": "SQL-Injection-01"
            },
            {
              "Name": "SQL-Injection-02"
            },
            {
              "Name": "SQL-Injection-03"
            },
            {
              "Name": "Source-Code-Disclosure"
            },
            {
              "Name": "Web-Application-Injection-01"
            },
            {
              "Name": "Web-Application-Injection-02"
            },
            {
              "Name": "Web-Application-Vulnerability-Exploit-01"
            },
            {
              "Name": "Web-Application-Vulnerability-Exploit-02"
            },
            {
              "Name": "Web-Application-Vulnerability-Exploit-03"
            },
            {
              "Name": "Web-Application-Vulnerability-Exploit-04"
            },
            {
              "Name": "Web-Application-Vulnerability-Exploit-05"
            },
            {
              "Name": "Web-Application-Vulnerability-Exploit-06"
            },
            {
              "Name": "Web-Application-Vulnerability-Exploit-07"
            },
            {
              "Name": "Web-Scanner-01"
            },
            {
              "Name": "Web-Scanner-02"
            },
            {
              "Name": "Web-Scanner-03"
            },
            {
              "Name": "Web-Server-Vulnerability-Exploit-01"
            },
            {
              "Name": "Web-Server-Vulnerability-Exploit-02"
            },
            {
              "Name": "Web-Server-Vulnerability-Exploit-03"
            },
            {
              "Name": "Web-Server-Vulnerability-Exploit-04"
            }
          ],
          "ScopeDownStatement": {
            "RegexPatternSetReferenceStatement": {
              "ARN": "",
              "FieldToMatch": {
                "UriPath": {}
              },
              "TextTransformations": [
                {
                  "Priority": 0,
                  "Type": "NONE"
                }
              ]
            }
          }
        }
      },
      "OverrideAction": {
        "None": {}
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "Fortinet-all_rules"
      }
    },
    {
      "Name": "DDOS_rate_rule",
      "Priority": 1,
      "Statement": {
        "RateBasedStatement": {
          "Limit": 350,
          "AggregateKeyType": "FORWARDED_IP",
          "ScopeDownStatement": {
            "NotStatement": {
              "Statement": {
                "IPSetReferenceStatement": {
                  "ARN": "",
                  "IPSetForwardedIPConfig": {
                    "HeaderName": "X-Forwarded-For",
                    "FallbackBehavior": "MATCH",
                    "Position": "FIRST"
                  }
                }
              }
            }
          },
          "ForwardedIPConfig": {
            "HeaderName": "X-Forwarded-For",
            "FallbackBehavior": "MATCH"
          }
        }
      },
      "Action": {
        "Block": {}
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "DDOS_rate_rule"
      }
    }
  ]

例如，我想要删除元素{ "Name": "OS-Command-Injection-01" }

Answer 1

要从数组中删除对象，可以使用以下模板：

walk(if type == "array”
     then map(select( 
      ( type=="object" and
        (.Name|IN( ... ) ) ) | not ))
     else . end)

Answer 2

|=对于修改数据结构的元素很有用。

• 左侧应该返回要修改的内容。(如果包含|.)
• The，请使用括号右侧的值被视为使用了|而不是|=.
• The，右侧应返回新值。(如果包含|.)
• The，则使用括号返回所做修改的.。

jq '
   ( .[].Statement.ManagedRuleGroupStatement.ExcludedRules | arrays ) |=
      map(select(.Name != "OS-Command-Injection-01"))
'

jqplay

Answer 3

您可以尝试这样做：

jq 'walk(if type=="object" and
            (.Name|IN("OS-Command-Injection-01","SQL-Injection-03"))
         then empty
         else . end)' input-file