Question

我正在处理AWS Cloudtrail log analysis的进程，我被困在一行中提取JSON，

这是我的表定义。

CREATE EXTERNAL TABLE cloudtrail_logs (
eventversion STRING,
eventName STRING,
awsRegion STRING,
requestParameters STRING,
elements STRING  ,
additionalEventData STRING
)
ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'
STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
LOCATION 's3://XXXXXX/CloudTrail'

如果我运行select elements from cl1 limit 1，则会返回此结果。

{"groupId":"sg-XXXX","ipPermissions":{"items":[{"ipProtocol":"tcp","fromPort":22,"toPort":22,"groups":{},"ipRanges":{"items":[{"cidrIp":"0.0.0.0/0"}]},"prefixListIds":{}}]}}

我需要将此结果显示为虚拟列，例如

| groupId | ipProtocol | fromPort | toPort| ipRanges.items.cidrIp|
|---------|------------|--------- | ------|-----------------------------|
| -1      | 0          |          |       |                             |

我正在使用AWS Athena，我尝试了横向视图，并且get_json_object在AWS中无效。

它是一个外部表

Answer 1

select  json_extract_scalar(i.item,'$.ipProtocol')  as ipProtocol
       ,json_extract_scalar(i.item,'$.fromPort')    as fromPort
       ,json_extract_scalar(i.item,'$.toPort')      as toPort

from    cloudtrail_logs
        cross join unnest (cast(json_extract(elements,'$.ipPermissions.items') 
            as array(json))) as i (item)
;

 ipProtocol | fromPort | toPort
------------+----------+--------
 "tcp"      | 22       | 22

蜂巢侧面视图不工作AWS Athena

1 个答案: