parseCFfirewallLog.py

import json
import argparse
import sys

KEYS_TO_KEEP = {
    "clientASNDescription",
    "clientCountryName",
    "clientIP",
    "datetime",
    "userAgent",
}


def filter_entries(data):
    """Accept a list of dicts or a single dict and return filtered version."""
    if isinstance(data, list):
        return [{k: entry.get(k) for k in KEYS_TO_KEEP} for entry in data]
    elif isinstance(data, dict):
        return {k: data.get(k) for k in KEYS_TO_KEEP}
    else:
        raise ValueError(f"Unsupported JSON structure: expected a list or dict, got {type(data).__name__}")


def main():
    parser = argparse.ArgumentParser(
        description="Filter a JSON file to only include specific keys."
    )
    parser.add_argument("input", help="Path to the input JSON file")
    parser.add_argument("output", help="Path to write the filtered JSON file")
    args = parser.parse_args()

    # Load input
    try:
        with open(args.input, "r", encoding="utf-8") as f:
            data = json.load(f)
    except FileNotFoundError:
        print(f"Error: Input file '{args.input}' not found.", file=sys.stderr)
        sys.exit(1)
    except json.JSONDecodeError as e:
        print(f"Error: Failed to parse JSON — {e}", file=sys.stderr)
        sys.exit(1)

    # Filter
    filtered = filter_entries(data)

    # Write output
    with open(args.output, "w", encoding="utf-8") as f:
        json.dump(filtered, f, indent=2, ensure_ascii=False)

    count = len(filtered) if isinstance(filtered, list) else 1
    print(f"Done. {count} record(s) written to '{args.output}'.")


if __name__ == "__main__":
    main()