zed VS yq

VAST is an open-source SecDataOps project for working with data from open-source security tools. Version 3.0 adds a pipeline syntax similar to splunk, Kusto, PRQL, and Zed.

Cool, I didn't realize you used sqlite-utils for your performance demo!

It's not particularly designed for speed - it should be fast as far as Python code goes (I use some generator tricks to stream data and avoid having to load everything into memory at once) but I wouldn't expect "sqlite-utils insert" to win any performance competitions with tools written in other languages.

Those benchmarks against sqlite itself are definitely interesting. I'm looking forward to playing with the "native ZNG support for Python" mentioned on https://github.com/brimdata/zed/blob/main/docs/libraries/pyt... when that becomes available.

Hi, all. Author here. Thanks for all the great feedback.

I've learned a lot from your comments and pointers.

The Zed project is broader than "a jq alternative" and my bad for trying out this initial positioning. I do know there are a lot of people out there who find jq really confusing, but it's clear if you become an expert, my arguments don't hold water.

We've had great feedback from many of our users who are really productive with the blend of search, analytics, and data discovery in the Zed language, and who find manipulating eclectic data in the ZNG format to be really easy.

Anyway, we'll write more about these other aspects of the Zed project in the coming weeks and months, and in the meantime, if you find any of this intriguing and want to kick the tires, feel free to hop on our slack with questions/feedback or file GitHub issues if you have ideas for improvements or find bugs.

Thanks a million!

https://github.com/brimdata/zed

In my observation, mock data has tended to be used in a rather loose, slipshod, careless manner. Unlike documentation, it is treated as the garbage of software material. (Sometimes even referred to as "garbage data"). People will try to avoid writing it by using elaborate "generators" such as jFairy or zed.

There are a few examples in the ZSON spec...

https://github.com/brimdata/zed/blob/main/docs/formats/zson....

And you can easily see whatever data you'd like formatted as ZSON using the "zq" CLI tool, but I just made this gist (with some data from the brimdata/zed-sample-data report) so you can have a quick look (the bstring stuff is a little noisy and an artifact of the data source being Zeek)... https://gist.github.com/mccanne/94865d557ca3de8abfd3eb09e8ac...

What I often use to just get the full key paths is yq (https://github.com/mikefarah/yq), piping into grep when necessary

  yq -o=props 

For more information about this command visit https://github.com/mikefarah/yq

I've been trying to install and config a plugin (papis.nvim) for a couple of days and am having issues with a function that uses io.popen to run yq to convert yaml files to json. I know my install of yq is fine- I can run yq -oj info.yaml from the command line with no issue and it produces the correct json output. I know the function can find the yq executable, but it returns nil. I've saved the error from the yq golang code: panic: runtime error: invalid memory address or nil pointer dereference

- yq has no if-then-else https://github.com/mikefarah/yq/issues/95 which is a poor design (or omission) in my opinion

After which, I use openapi-generator to make a yaml output.

https://gist.github.com/freshteapot/3637e8d2b5ecdf01b7d25246...

- yq version 3.4.1 (Worth noting, the example uses an out of date yq, so a few modifictaions might be needed)

https://github.com/mikefarah/yq

For those pining for a similar yaml query tool for working through acres of config: https://github.com/mikefarah/yq

jq is awesome and thanks to the new team for their recent efforts and energy, it massively appreciated.

For anyone looking for such a script, there's some CLIs that make it easy. One is `yq -o props` [1], another way is to use `yq -j` or `yj` [2] to convert to JSON and pipe it to `gron` [3].

[1] https://github.com/mikefarah/yq

[2] https://github.com/sclevine/yj

[3] https://github.com/tomnomnom/gron