Problem square bracket JSONPath - Nikto

[Hibouxi]

Hello !

I followed this tutorial (https://blog.zabbix.com/security-rel...h-zabbix/8659/), the part "Advanced Vulnerability scans".

But the problem is, when I tried to get the value of id, instead of having something like 235768 I have ["235768"].

And when the item is created, it looks like : Vulnerability LLD: Vulnerability data ["999955"]: Vulnerability ["999955"] and the key : vulnerability["["999955"]"]

Here is the JSONPath that I set : $.[?(@.id == {#ID})].msg if i replaced the value {#ID} by 235768 for example, it is working and I get the message.

My LLD macro is : {#ID} = $..['id']

And I don't know what to do, because the value comes from the macro... and I don't think it's possible to modify the macro.

Thank you.
Best regards.

[Markku]

Hi, this is just a shot in the dark (I didn't test any of this here), but how about just trying the LLD macro without the brackets and quotes, like this: $..id (or is it $.id)

Markku

[Noobz]

Was this resolved? I'm having the same issue and because the macro is then used in an item prototype JSON path, it won't return any information because of the [ ] doesn't match the actual JSON

[tikkami]

Maybe replace could be used to get rid of square brackets.

[Noobz]

The issue is seems to be intended behavior. I have no idea how it could be useful to behave the way it does though.

https://www.zabbix.com/documentation/current/en/manual/config/items/preprocessing/jsonpath_functionality

"Matched element names can be extracted by adding a ~ suffix to the JSONPath. It returns the name of the matched object or an index in string format of the matched array item. The output format follows the same rules as other JSONPath queries - definite path results are returned 'as is' and indefinite path results are returned in array. However there is not much point of extracting the name of an element matching a definite path - it's already known."

[cyber]

Add additional preprocessing step to extract number from that ["xxxxxx"] construct. regex for example \["(\d+)"\] and output \1

[Noobz]

Add additional preprocessing step to extract number from that ["xxxxxx"] construct. regex for example \["(\d+)"\] and output \1

The brackets only exist once the macro has been resolved - they don't exist in the original JSON - I'm unsure where one would apply that preprocessing step when the issue is the macro, not the data.

[cyber]

First step - jsonpath. extracts something from original json. you seem to get a ["xxxxx"] as a result. So add second step right there...

But if you do not have those in original data, then there should be something else that can be done, I think. Data extraction should not add anything. But there is no example data here to experiment...

[ISiroshtan]

Noobz can you actually show original JSON and JSON.path you use? If you use filtering ( $.phoneNumbers[?(@.type == 'home')].number for example) it is expected to return value with [] as result is actually an array of values (in your case an array with single value). You can update JSON.path with Zabbix supported function .first() ( like $.phoneNumbers[?(@.type == 'home')].number.first() ) which returns first value of resulting array, which means it be actually value and not array ( with no [] ).

Hope it helps.

[jochristian]

Noobz
Did you find an fix for this issue? We are struggling with the same thing.
Zabbix adds []. Unable to see why this happens.

[ISiroshtan]

Can you post the JSON sample you take as input and pre-processing rule you using?

[jochristian]

Hello again,

So after some more testing we actually found something that works.
We added .first() in the LLD configuration like this:


This works for us as far as I can see. Not exactly sure why...

/Jo Christian

[Noobz]

Yep, the .first() solution works, but it is not apparent exactly why it works, it certainly isn't intuitive.

[Markku]

Yep, the .first() solution works, but it is not apparent exactly why it works, it certainly isn't intuitive.

From the linked documentation:

Output value


JSONPaths can be divided in definite and indefinite paths. A definite path can return only null or a single match. An indefinite path can return multiple matches, basically JSONPaths with detached, multiple name/index list, array slice or expression segments. However, when a function is used the JSONPath becomes definite, as functions always output single value.

A definite path returns the object/array/value it's referencing, while indefinite path returns an array of the matched objects/arrays/values.

Maybe you can provide a sample of the JSON if more clarification is needed?

Markku

[Noobz]

From the linked documentation:



Maybe you can provide a sample of the JSON if more clarification is needed?

Markku

It was that long ago I can't even remember the template I was working on, or what type of device it was for sorry!

[eertul]

Hello again,

So after some more testing we actually found something that works.
We added .first() in the LLD configuration like this:


This works for us as far as I can see. Not exactly sure why...

/Jo Christian

Thanks! "first()" function nailed it!