Repository: rcoh/angle-grinder (language: rust)

Issue:
Parsing embedded JSON
Hi,

I have the following JSON format:

{"dst_host": "159.65.224.130", "dst_port": 23, "honeycred": false, "local_time": "2019-01-23 11:57:11.834296", "logdata": {"PASSWORD": "1111", "USERNAME": "root"}, "logtype": 6001, "node_id": "opencanary-1", "src_host": "41.139.253.2", "src_port": 36653}

How would I get agrind to also parse the logdata field?

TIA!


Discussion / hints:
Nested JSON isn't super well supported right now, but try: `a`
`agrind '* | json | json from logdata`:

```
echo '{"dst_host": "159.65.224.130", "dst_port": 23, "honeycred": false, "local_time": "2019-01-23 11:57:11.834296", "logdata": {"PASSWORD": "1111", "USERNAME": "root"}, "logtype": 6001, "node_id": "opencanary-1", "src_host": "41.139.253.2", "src_port": 36653}' 
| agrind '* | json | json from logdata | fields PASSWORD, USERNAME'
[PASSWORD=1111]            [USERNAME=root]
```


You can use the fields operator to drop the other fields if you want.

Fix patch:
diff --git a/README.md b/README.md
index 19ec2dc..5caee64 100644
--- a/README.md
+++ b/README.md
@@ -64,7 +64,7 @@ These operators have a 1 to 1 correspondence between input data and output data.
 
 ##### JSON
 `json [from other_field]`: Extract json-serialized rows into fields for later use. If the row is _not_ valid JSON, then it is dropped. Optionally, `from other_field` can be 
-specified.
+specified. Embedded JSON isn't natively supported, but you can use the `json from` to reparse nested keys (see examples).
 
 *Examples*:
 ```agrind
@@ -73,6 +73,14 @@ specified.
 ```agrind
 * | parse "INFO *" as js | json from js
 ```
+
+Given input like:
+```
+{"key": "blah", "nested_key": {"this": "that"}}
+```
+```agrind
+* | json | json from nested_key | fields this
+```
 ![json.gif](/screen_shots/json.gif)
 
 ##### Parse


Test patch: