E-JQ
jq
Filter and reshape JSON from APIs, cloud CLIs, and loot files in a one-liner.
OVERVIEW
jq (jqlang.org) is a small C binary that reads JSON from stdin or a file and runs a filter over it — select keys, map arrays, build a new object — with no runtime beyond the binary itself. That makes it the default glue between curl, kubectl, the AWS/Azure/gcloud CLIs, and whatever you want to pipe next.
`.` pretty-prints. `.items[].metadata.name` walks a typical Kubernetes list. `-r` strips quotes so the result is a plain host list. Filters are programs; keep them in a file once they grow past a one-liner, and keep a copy next to the raw JSON so the report can show how a number was derived.
USE CASES
Practical use cases
- 01
Pulling a column of hostnames or IDs out of a cloud CLI JSON dump.
- 02
Pretty-printing an API response saved from curl before reading it.
- 03
Building a CSV or host list for the next scanner from mixed JSON loot.
- 04
Checking whether a secret or token key is present in a captured document.
QUICK START
When a tool or API already gave you JSON and you need a field, a table, or a host list instead of reading the blob by eye.
- Keep the raw JSON; run jq against a copy so you can rerun the filter.
- Start with `.` to confirm the document parses.
- Walk to the array or object you care about, then `-r` the field you want.
- Save the filter next to the input when the derivation will appear in the report.
jq -r '.items[].metadata.name' pods.jsonBEFORE YOU RUN IT
What to check before running it
A wrong path yields empty output, not an error — spot-check counts against the raw document before treating a list as complete.
jq will happily print secrets that sat in the JSON; treat filtered output with the same handling rules as the source file.
Huge documents can exhaust memory; stream with `--stream` or split the input rather than loading a multi-gigabyte dump.