fleet/schema/tables/parse_json.yml

name: parse_json
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
description: Parses an entire file as JSON. See `parse_jsonl` where multiple JSON documents are supported.
platforms: 
  - darwin
  - windows
  - linux
evented: false
columns:
  - name: path
    description: Path of the file to read.
    required: true
    type: text
  - name: fullkey
    description: Same as `key` in this table. See `parse_jsonl` where multiple JSON documents are supported.
    required: false
    type: text
  - name: parent
    description: Parent key when keys are nested in the document.
    required: false
    type: text
  - name: key
    description: JSON key or array index.
    required: false
    type: text
  - name: value
    description: JSON value
    required: false
    type: text
Add `parse_json`, `parse_jsonl`, `parse_xml`, and `parse_ini` tables to fleetd (#18035) For #17577 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (performed only on macOS) 2024-04-03 16:13:04 +00:00			`name: parse_json`
			`notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).`
			description: Parses an entire file as JSON. See `parse_jsonl` where multiple JSON documents are supported.
			`platforms:`
			`- darwin`
			`- windows`
			`- linux`
			`evented: false`
			`columns:`
			`- name: path`
			`description: Path of the file to read.`
			`required: true`
			`type: text`
			`- name: fullkey`
			description: Same as `key` in this table. See `parse_jsonl` where multiple JSON documents are supported.
			`required: false`
			`type: text`
			`- name: parent`
			`description: Parent key when keys are nested in the document.`
			`required: false`
			`type: text`
			`- name: key`
			`description: JSON key or array index.`
			`required: false`
			`type: text`
			`- name: value`
			`description: JSON value`
			`required: false`
			`type: text`