ElasticSearch api parse nested string json dashboard

Question

I am using ElasticSearch GET to get the json file of a dashbaord: for example: http://ES_IP:9200/kibana-int/dashboard/my_Dashboard/

This returns me a json file like:

{"_index":"kibana-int","_type":"dashboard","_id":"my_Dashboard","_version":5,"found":true,"_source":{ "user":"guest", "group":"guest", "title":"my_Dashboard", "dashboard":"{ \"title\": \"My Dashboard\", \"services\": { \"query\": { \"list\": { \"0\": { \"id\": 0, \"type\": \"lucene\", \"query\": \"type:dh AND severity:ERROR AND (response.baseUrl:\"/rm/recordings/*\" OR request.baseUrl:\"/rm/recordings/*\")\", \"alias\": \"DH errors rcc\",.......

Here is where I need your help, how can I get the value of the key "dashboard" but without the escaped '\' character in the key/val pair not affecting the escaped that are part of the values?

The output that I need should be something like:

{ "title": "My Dashboard", "services": { "query": { "list": { "0": { "id": 0, "type": "lucene", "query": "type:dh AND severity:ERROR AND (response.baseUrl:\"/rm/recordings/*\" OR request.baseUrl:\"/rm/recordings/*\")", "alias": "DH errors rcc",.......

Pay attention in the query key, in its value, there are some \" that shouldn't be affected, since they are part of the value.

I need that output to then parse that json with jq in a some bash script I have.

Does ElasticSearch api have some filter to provide me that output? Or do you know another external method to get what I need?

Thanks a lot for the help.

Answer 1

fromjson is your friend. For example:

def data: {
  "_index": "kibana-int",
  "_type": "dashboard",
  "_id": "my_Dashboard",
  "_version": 5,
  "found": true,
  "_source": {
    "user": "guest",
    "group": "guest",
    "title": "my_Dashboard",
    "dashboard": "{ \"title\": \"My Dashboard\", \"services\": { \"query\": { \"list\": { \"0\": \"foobar\" }}}}"
  }
};

data | ._source.dashboard | fromjson

Output:

$ jq -n -f elastic.jq
{
  "title": "My Dashboard",
  "services": {
    "query": {
      "list": {
        "0": "foobar"
      }
    }
  }
}