如何仅从字典/json 中提取特定字段？

Question

I am trying to create a new dictionary to extract only specific fields, I only want the "process_hash", "process_name", "process_effective_reputation" fields.

The code below sort of works but it only extracts the first item, I would like to extract all the items but only for "process_hash", "process_name", "process_effective_reputation" fields

JSON:

{'results': [{'device_name': 'faaadc2',
          'device_timestamp': '2020-10-27T00:50:46.176Z',
          'event_id': '9b1bvfaa11eb81b',
          'process_effective_reputation': 'LIST5',
          'process_hash': ['bfc7dcf5935f3avda9df8e9b6425c37a',
                           'ca9f3a2450asd518fc939a33c100b2d557f96e040f712f6dd4641ad1734e2f19'],
          'process_name': 'c:\\program files '
                          '(x86)\\to122soft\\thcaadf3\\tohossce.exe',
          'process_username': ['JOHN\\user1']},
         {'device_name': 'fk6saadc2',
          'device_timestamp': '2020-10-27T00:50:46.176Z',
          'event_id': '9b151f6e17ee11eb81b',
          'process_effective_reputation': 'LIST1',
          'process_hash': ['bfc7dcf5935f3a9df8e9baaa425c37a',
                           'ca9f3aaa506cc518fc939a33c100b2d557f96e040f712f6dd4641ad1734e2f19'],
          'process_name': 'c:\\program files '
                          '(x86)\\oaaft\\tf3\\toaaotsice.exe',
          'process_username': ['JOHN\\user2']},
         {'device_name': 'sdddsdc2',
          'device_timestamp': '2020-10-27T00:50:46.176Z',
          'event_id': '9b151f698e11eb81b',
          'process_effective_reputation': 'LIST',
          'process_hash': ['9df8ebfc7dcf5935830f3a9b6asdcd7a',
                           'ca9f3a24506cc518fdfrcv39a33c100b2d557f96e040f7124641ad1734e2f19'],
          'process_name': 'c:\\program files '
                          '(x86)\\toht\\thaa3\\toasce.exe',
          'process_username': ['JOHN\\user3']}]}

Code:

response = json.loads(r.text)
r = response['results']

selected_fields = []
for d in r:
    selected_fields.append({k: d[k] for k in ("process_hash", "process_name", "process_effective_reputation")})

new_data = []
for data in selected_fields:
    fieldnames = 'md5 sha256 process_name process_effective_reputation'.split()
    row = {'md5': data['process_hash'][0], 'sha256': data['process_hash'][1]}
    # Copy process_name and process_effective_reputation fields.
    row.update({fieldname: data[fieldname] for fieldname in fieldnames[-2:]})
    new_data.append(row)
return new_data

UPDATE:

thank you Lauren Boland for the code, this worked and Nattelar for the explanation.

i have attached the new code, i am trying to split the process hash fields into two fields, so that it's "md5" "sha256" "process_name" "process_effective_reputation", i've tried the code above but i get row = {'md5': data['process_hash'][0], 'sha256': data['process_hash'][1]} IndexError: list index out of range

Thank you

Answer 1

You were overwriting the selected_fields dictionary in every iteration of your for loop.

Try making it a list instead. It will return a list of dictionaries.

selected_fields = []
for d in r:
    selected_fields.append({k: d[k] for k in ("process_hash", "process_name", "process_effective_reputation")})
return selected_fields

Answer 2

Even though there's already an answer I want to point out what's happening here.

When you try to make a variable equals to something you will end up overwriting the value that was there before, which is why your code is not working. But even if you tried to use use selected_fields.update() it wouldn't work cause the keys names are the same, and now the values of the keys would be overwrite.

When doing this kind of thing you generally have to maintain the original type of the structure, that in the case of selected_fields['Results'] is a list