Working within the SSLOG schema

flaten_sslogs.py

import json

def dummy(element):
    return element

def get_value(_dict):
    try:
        return _dict.get('value', _dict)
    except AttributeError:
        return _dict
    
def get_oid(_dict):
    try:
        return _dict.get('$oid', _dict)
    except AttributeError:
        return _dict
    
def get_timestamp(_dict):
    try:
        return _dict.get('$date', _dict)
    except AttributeError:
        return _dict


def flaten_sslogs_from_file(fname):
    sslogs = {}
    with open(fname) as fd:
        j = json.load(fd)
        return {get_oid(r['_id']): {
            k: get_value(v)   
            for k,v in r['data']['fieldvalues'].items()
          } 
          for r in j 
        }
    
def get_timestamp_from_file(fname):
    with open(fname) as fd:
        j = json.load(fd)
        return {get_oid(r['_id']): get_timestamp(r['data']['timestamp']) for r in j}
    
def get_data_element(fname, element, preprocess=dummy, default=None):
    with open(fname) as fd:
        j = json.load(fd)
        return {get_oid(r['_id']): preprocess(r['data'].get(element, default)) for r in j}