Skip to main content

jq

Transforms and filters messages using jq queries.

# Common config fields, showing default values
label: ""
jq:
query: "" # No default (required)
Try out Bloblang

For better performance and improved capabilities try out native Bento mapping with the mapping processor.

The provided query is executed on each message, targeting either the contents as a structured JSON value or as a raw string using the field raw, and the message is replaced with the query result.

Message metadata is also accessible within the query from the variable $metadata.

This processor uses the gojq library, and therefore does not require jq to be installed as a dependency. However, this also means there are some differences in how these queries are executed versus the jq cli which you can read about here.

If the query does not emit any value then the message is filtered, if the query returns multiple values then the resulting message will be an array containing all values.

The full query syntax is described in jq's documentation.

Error Handling

Queries can fail, in which case the message remains unchanged, errors are logged, and the message is flagged as having failed, allowing you to use standard processor error handling patterns.

Fields

query

The jq query to filter and transform messages with.

Type: string

raw

Whether to process the input as a raw string instead of as JSON.

Type: bool
Default: false

output_raw

Whether to output raw text (unquoted) instead of JSON strings when the emitted values are string types.

Type: bool
Default: false

Examples

When receiving JSON documents of the form:

{
"locations": [
{"name": "Seattle", "state": "WA"},
{"name": "New York", "state": "NY"},
{"name": "Bellevue", "state": "WA"},
{"name": "Olympia", "state": "WA"}
]
}

We could collapse the location names from the state of Washington into a field Cities:

{"Cities": "Bellevue, Olympia, Seattle"}

With the following config:

pipeline:
processors:
- jq:
query: '{Cities: .locations | map(select(.state == "WA").name) | sort | join(", ") }'