example input:
[helb@kookaburra~/tmp/alienvault] $ cat input.json
{
"indicators": [
{
"indicator": "127.0.0.1",
"description": "",
"created": "2018-03-13T00:53:33",
"title": "",
"content": "",
"type": "IP",
"id": 436388206
},
{
"indicator": "624762a90b7272e247e5022576b7912d1aa0b32bc13aabc7ee47197e5b87a41b",
"description": "",
"created": "2018-03-13T00:53:33",
"title": "",
"content": "",
"type": "FileHash-SHA256",
"id": 436388207
}
]
}
convert to CSV:
[helb@kookaburra~/tmp/alienvault] $ cat input.json | fx 'o => (o.indicators.map(i => `${i.type}, ${i.indicator}`)).join(", ")'
IP, 127.0.0.1, FileHash-SHA256, 624762a90b7272e247e5022576b7912d1aa0b32bc13aabc7ee47197e5b87a41b
filtering just IPs:
[helb@kookaburra~/tmp/alienvault] $ cat input.json | fx 'o => (o.indicators.filter(i => i.type == "IP").map(i => `${i.type}, ${i.indicator}`)).join(", ")'
IP, 127.0.0.1
(just the .filter(i => i.type == "IP")
part was added)