JQ错误:尝试映射IP和端口时无法迭代字符串

Question

我有一个下面的json输出，我希望删除重复的数据，并使用jq将数据映射为表格式。我正在使用下面的查询，但我一直收到一个错误；

无法迭代字符串("78.45.196…(

e.t.c.

Json数据

[
{
"ip": "78.45.196.23",
"timestamp": "1616566245",
"ports": [
{
"port": 5060,
"proto": "tcp",
"status": "open",
"reason": "syn-ack",
"ttl": 50
}
]
},
{
"ip": "67.89.378.82",
"timestamp": "1616566255",
"ports": [
{
"port": 2000,
"proto": "tcp",
"status": "open",
"reason": "syn-ack",
"ttl": 50
}
]
},
{
"ip": "67.89.378.82",
"timestamp": "1616566255",
"ports": [
{
"port": 2080,
"proto": "tcp",
"status": "open",
"reason": "syn-ack",
"ttl": 50
}
]
},
{
"ip": "78.45.196.23",
"timestamp": "1616566245",
"ports": [
{
"port": 5060,
"proto": "tcp",
"status": "open",
"reason": "syn-ack",
"ttl": 50
}
]
},
{
"ip": "67.89.378.82",
"timestamp": "1616566255",
"ports": [
{
"port": 2000,
"proto": "tcp",
"status": "open",
"reason": "syn-ack",
"ttl": 50
}
]
},
{
"ip": "78.45.196.23",
"timestamp": "1616566245",
"ports": [
{
"port": 5080,
"proto": "tcp",
"status": "open",
"reason": "syn-ack",
"ttl": 50
}
]
}
]

我的查询

jq -r '.[][] | group_by(.ip) | map({ip: .ip, ports: map(.ports[].port) | add | unique})' jsonfile.json

预期输出

• 删除重复项并获取ip和端口
• 或者可以向我解释如何从IP和端口中获得唯一值吗

[
{"ip:" "67.89.378.82", "ports:"[2000, 2080]},
{"ip:" "78.45.196.23", "ports:"[5060, 5080]}
]

Answer 1

在group_by()之后立即构建所需的JSON

group_by(.ip) | 
map
( 
{ 
ip:    .[0].ip, 
ports: [ .[].ports[].port ] | unique 
} 
)

jq播放链接

---

丢弃只有端口为0 的IP的后续问题

group_by(.ip) | 
map
( 
{ 
ip:    .[0].ip, 
ports: [ .[].ports[] | select(.port != 0 ).port ] | unique
} |
select(.ports | length > 0) 
)