使用JmesPath过滤CloudTrail日志

Question

我正在编写一个boto脚本，使用JmesPath过滤掉cloudtrail。
JmesPath应该将输出作为bucket的名称。我不确定什么是正确的语法。提前谢谢

logs = cloudtrail.create_trail(
  Name='GoodTrail',
  S3BucketName='goodbucket3',
)
print(logs)
        
path = jmespath.search('logs',{'S3BucketName': ''}})
print(path)

这就是print(logs)给出的结果：

{
    "Name": "GoodTrail",
    "S3BucketName": "goodbucket3",
    "IncludeGlobalServiceEvents": true,
    "IsMultiRegionTrail": false,
    "TrailARN": "arn:aws:cloudtrail:us-east-1:XXXXXXXXXXX:trail/GoodTrail",
    "LogFileValidationEnabled": false,
    "IsOrganizationTrail": false,
    "ResponseMetadata": {
        "RequestId": "520fdfae-02ea-4695-857c-c47c7bcb00dd",
        "HTTPStatusCode": 200,
        "HTTPHeaders": {
            "x-amzn-requestid": "520fdfae-02ea-4695-857c-c47c7bcb00dd",
            "content-type": "application/x-amz-json-1.1",
            "content-length": "242",
            "date": "Fri, 18 Dec 2020 15:48:26 GMT"
        },
        "RetryAttempts": 0
    }
}

Answer 1

这方面的三个主要问题：

path = jmespath.search('logs',{'S3BucketName': ''}})

1. 在使用JMESPath search函数时，必须将表达式作为第一个参数，将JSON文档作为第二个参数，而在这里，则相反。

   search(<jmespath expr>, <JSON document>) -> <return value>
   

   ^{来源：https://jmespath.org/specification.html#jmespath-specification}
   因此，你应该：

   path = jmespath.search('some-search-experssion', some_variable)
   

2. 您正在将字符串'logs'传递给search函数，而不是包含JSON文档本身的变量logs，因此它应该是

   path = jmespath.search('some-search-experssion', logs)
   

3. 要搜索像您这样的简单对象，您只需要立即引用对象的键，因此您的搜索表达式应该是：S3BucketName

   path = jmespath.search('S3BucketName', logs)
   

---

因此，通过脚本test.py：

import jmespath

logs = {
    "Name": "GoodTrail",
    "S3BucketName": "goodbucket3",
    "IncludeGlobalServiceEvents": True,
    "IsMultiRegionTrail": False,
    "TrailARN": "arn:aws:cloudtrail:us-east-1:562922379100:trail/GoodTrail",
    "LogFileValidationEnabled": False,
    "IsOrganizationTrail": False,
    "ResponseMetadata": {
        "RequestId": "520fdfae-02ea-4695-857c-c47c7bcb00dd",
        "HTTPStatusCode": 200,
        "HTTPHeaders": {
            "x-amzn-requestid": "520fdfae-02ea-4695-857c-c47c7bcb00dd",
            "content-type": "application/x-amz-json-1.1",
            "content-length": "242",
            "date": "Fri, 18 Dec 2020 15:48:26 GMT"
        },
        "RetryAttempts": 0
    }
}

#print(logs)

path = jmespath.search('S3BucketName', logs)
print(path)

给出：

$ python3 test.py 
goodbucket3