Skip to content

Handling empty JSON objects #1069

@philrz

Description

@philrz

I came across this problem while working with Suricata EVE JSON data. Repro is with zq commit 07fc77b.

Consider the following NDJSON:

$ cat empty_object.ndjson 
{"ja3s":{}}

If read & re-written as NDJSON via zq, the original representation is not preserved.

$ cat empty_object.ndjson | zq -f ndjson -
{"ja3s":null}

Also, if I convert to binary ZNG as an intermediate step, a downstream zq sees it as unreadable.

$ cat empty_object.ndjson | zq - | zq -i zng -f ndjson -
/dev/stdin: type record: zero columns not allowed

On this last point, I suspected this might be expected behavior, since the Section 3.1.1.1 of the ZNG spec says:

A record may not contain zero columns.

However, we'd like to be able to represent any valid NDJSON in ZNG, so it seems we'll want to address this.

FWIW, other JSON tools such as jq do not complain.

$ cat empty_object.ndjson | jq .
{
  "ja3s": {}
}

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions