Convert a flat JSON to a TSV file with column headers

Question

I am reformatting some JSON with JQ into a TSV file. I am able to create a TSV with the values only, but I cannot figure out how to include a single row with the key values as column headers?

Sample input:

{
"id":"1234",
"host":"6789",
"proto":"UDP",
"location":"Boston",
"timestamp":"2020-12-01T14:18:45.717Z",
"src_ip":"192.168.3.70",
"dest_ip":"8.8.8.8",
"dest_port":53,
"message":"Some Information",
"severity":1,
"details":"Some Details",
"categories":["a","b","c"]
}

Desired output:

"location\ttimestamp\tsrc_ip\tdest_ip\tdest_port"
"Boston\t2020-12-01T15:13:16.242Z\t10.8.25.63\t10.8.1.3\t445"
"Atlanta\t2020-12-01T15:11:15.929Z\t10.8.25.63\t10.80.1.3\t445"
"Chicago\t2020-12-01T15:09:45.271Z\t10.34.196.12\t10.8.1.3\t445"

This statement gets me close:

cat input.json | jq  '. | to_entries 
| map(select(.key=="timestamp"), select(.key=="location"), select(.key=="src_ip"), select(.key=="dest_ip"), select(.key=="dest_port"))
| map(.key), map(.value) 
| @tsv'

But the header line is repeated in the output:

"location\ttimestamp\tsrc_ip\tdest_ip\tdest_port"
"Boston\t2020-12-01T15:13:16.242Z\t10.8.25.63\t10.8.1.3\t445"
"location\ttimestamp\tsrc_ip\tdest_ip\tdest_port"
"Atlanta\t2020-12-01T15:11:15.929Z\t10.8.25.63\t10.80.1.3\t445"

Is there a way to print the keys on the first row only, and then print only the values on the remaining rows, using only JQ?

Answer 1

One way to make such a flat object JSON to a TSV format, using the @tsv function would be to do

jq -n ' ["location", "timestamp", "src_ip", "dest_ip", "dest_port"] as $hdr | 
        $hdr, ( inputs | [ .[ $hdr[] ] ] ) | @tsv'

This works, by reusing the key fields as in the header, .[ $hdr[] ] is a simple trick to expand values of each of the literal fields in the hdr array to their corresponding values in the object (see Generic Object Index ). By surrounding it in the brackets, you get the selected field values in an array. With this array collected and the header array, apply the @tsv function to get the tabular form.

jq play snippet - Demo