JQ filtering inconsistency?
When designing a JQ filter, I wanted to make it apply only on some given condition. I used condition keyword. However, it has a bit different behavior than the expression itself. The condition is by default applied at the level of the array rather than at root. This configuration snippet is an example:
processors:
proc1:
event-jq:
condition: has("values")
expression: .[].values |= with_entries(select(.key | test("route/protocol-name|route/prefix$|route/prefix-length-xr|interface-name")))
In the expression I need to specify .[], but for the condition I just need to write has("values") rather than .[] | has("values"). Same as I expected any(has("values")) to work, but it doesn't. Is this a design choice? Wouldn't this cause some issues for more advanced cases where the array has more than one element?
That is by design.
The condition is evaluated against each individual event message within a group. For the processor logic to be applied, the condition must be true for at least one event message in the group. This approach ensures that if any single update within a gNMI notification meets the criteria, the associated processing logic is triggered for the entire group of events.
The expression operates on the entire collection of event messages as a single entity. It allows for the combination of tags or the consolidation of values from separate messages.