-
Notifications
You must be signed in to change notification settings - Fork 70
Closed
Description
I came across this problem while working with Suricata EVE JSON data. Repro is with zq commit 07fc77b.
Consider the following NDJSON:
$ cat empty_object.ndjson
{"ja3s":{}}
If read & re-written as NDJSON via zq, the original representation is not preserved.
$ cat empty_object.ndjson | zq -f ndjson -
{"ja3s":null}
Also, if I convert to binary ZNG as an intermediate step, a downstream zq sees it as unreadable.
$ cat empty_object.ndjson | zq - | zq -i zng -f ndjson -
/dev/stdin: type record: zero columns not allowed
On this last point, I suspected this might be expected behavior, since the Section 3.1.1.1 of the ZNG spec says:
A record may not contain zero columns.
However, we'd like to be able to represent any valid NDJSON in ZNG, so it seems we'll want to address this.
FWIW, other JSON tools such as jq do not complain.
$ cat empty_object.ndjson | jq .
{
"ja3s": {}
}
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels