Substation delete repeat key from array

[viraj-lunani]

hey I have the following situation
The cloudtrail log has a field called TagSpecification, this field can occur at different levels of the log, but it is leading to errors in our downstream pipeline because of duplicate "tag" fields

{
    "requestParameters": {
        "RandomField": { {"PotentialOtherField":
            "TagSpecification": [
                {
                    "tag": "value",
                    "Tag": []
                },
                {
                    "tag": "value",
                    "Tag": []
                }
            ]
        } }
    }
}

it may also be the case that the TagSpecification is not a list e.g.

{
    "requestParameters": {
        "RandomField": { {"PotentialOtherField":
            "TagSpecification": { 
                "tag": "value",
                "Tag": []
            } 
        } }
    }
}

I want to delete the lowercase tag from each element of the list (or from the TagSpecification field if it is an object and not a list), how can I do this with the consideration that this field can occur at varying levels of the log?

To be clear anytime there is a TagSpecification field (at any level of the log), I want to remove the tag field if it is an object, and if it is an array, i want to remove the tag field from every element of that array.

[jshlbrd]

@viraj-lunani There's a meta transform that can operate on values inside of a JSON array, you can build upon this:

local sub = import '../../../../../build/config/substation.libsonnet';

{
  transforms: [
    sub.tf.meta.for_each({
      object: { source_key: 'requestParameters.RandomField.PotentialOtherField.TagSpecification', target_key: 'requestParameters.RandomField.PotentialOtherField.TagSpecification' },
      transform: sub.tf.object.delete({ object: { source_key: 'tag'}})
    }),
    sub.tf.send.stdout(),
  ],
}

You can stack JSON paths to handle objects and arrays like this:

local sub = import '../../../../../build/config/substation.libsonnet';

{
  transforms: [
    sub.tf.obj.delete({ object: { source_key: 'requestParameters.RandomField.PotentialOtherField.TagSpecification.tag'}}),
    sub.tf.meta.for_each({
      object: { source_key: 'requestParameters.RandomField.PotentialOtherField.TagSpecification', target_key: 'requestParameters.RandomField.PotentialOtherField.TagSpecification' },
      transform: sub.tf.object.delete({ object: { source_key: 'tag'}})
    }),
    sub.tf.send.stdout(),
  ],
}

Your sample input isn't valid JSON, but the above was tested with this:

{"requestParameters":{"RandomField":{"PotentialOtherField":{"TagSpecification":[{"tag":"value","Tag":[]},{"tag":"value","Tag":[]}]}}}}
{"requestParameters":{"RandomField":{"PotentialOtherField":{"TagSpecification":{"tag":"value","Tag":[]}}}}}