jq: only required fields if the field n is equal to x - jq

Question

I have the following file:
[
{
"code": 200,
"status": "OK",
"result": {
"query": "123",
"hits": [
{
"ip": "2.14.11.41",
"services": [
{
"port": 22,
"service_name": "SSH",
"transport_protocol": "TCP"
},
{
"port": 80,
"service_name": "HTTP",
"transport_protocol": "TCP"
},
{
"port": 5900,
"service_name": "VNC",
"transport_protocol": "TCP"
},
{
"port": 8001,
"service_name": "HTTP",
"certificate": "62345a087218e",
"transport_protocol": "TCP"
}
],
"location": {
"continent": "Asia",
"country": "Israel",
"country_code": "IL",
"timezone": "Asia/Jerusalem",
"coordinates": {
"latitude": 31.5,
"longitude": 34.75
},
"registered_country": "Israel",
"registered_country_code": "IL"
},
"autonomous_system": {
"asn": 12400,
"description": "PARTNER-AS",
"bgp_prefix": "2.54.0.0/17",
"name": "PARTNER-AS",
"country_code": "IL"
},
"last_updated_at": "2022-05-18T13:09:19.288Z"
},
{
"ip": "2.22.22.102",
"services": [
{
"port": 22,
"service_name": "SSH",
"transport_protocol": "TCP"
},
{
"port": 80,
"service_name": "HTTP",
"transport_protocol": "TCP"
},
{
"port": 5901,
"service_name": "VNC",
"transport_protocol": "TCP"
},
{
"port": 8001,
"service_name": "HTTP",
"certificate": "6875897649b700a087218e",
"transport_protocol": "TCP"
},
{
"port": 8089,
"service_name": "HTTP",
"transport_protocol": "TCP"
}
],
"location": {
"continent": "Asia",
"country": "Israel",
"country_code": "IL",
"city": "Herzliya",
"timezone": "Asia/Jerusalem",
"province": "Tel Aviv",
"coordinates": {
"latitude": 32.1679,
"longitude": 34.834
},
"registered_country": "Israel",
"registered_country_code": "IL"
},
"autonomous_system": {
"asn": 12400,
"description": "PARTNER-AS",
"bgp_prefix": "2.55.0.0/17",
"name": "PARTNER-AS",
"country_code": "IL"
},
"last_updated_at": "2022-05-18T13:50:58.807Z"
},
{
"ip": "4.54.84.19",
"services": [
{
"port": 22,
"service_name": "SSH",
"transport_protocol": "TCP"
},
{
"port": 443,
"service_name": "HTTP",
"certificate": "8120978819a83e",
"transport_protocol": "TCP"
},
{
"port": 502,
"service_name": "MODBUS",
"transport_protocol": "TCP"
},
{
"port": 5900,
"service_name": "VNC",
"transport_protocol": "TCP"
}
],
"location": {
"continent": "Asia",
"country": "Israel",
"country_code": "IL",
"city": "Ashdod",
"timezone": "Asia/Jerusalem",
"province": "Southern District",
"coordinates": {
"latitude": 31.7915,
"longitude": 34.6497
},
"registered_country": "Israel",
"registered_country_code": "IL"
},
"autonomous_system": {
"asn": 12400,
"description": "PARTNER-AS",
"bgp_prefix": "2.55.0.0/17",
"name": "PARTNER-AS",
"country_code": "IL"
},
"last_updated_at": "2022-05-18T12:36:13.141Z"
}
],
"links": {
"next": "eyJ9I6MH0=",
"prev": ""
}
}
}
]
I'm trying to get the following format out of it:
2.14.11.41:80
2.14.11.41:8001
2.22.22.102:80
2.22.22.102:8001
2.22.22.102:8089
4.54.84.19:443
i.e. select IP and port if service_name is equal to HTTP. I know how to get IP jq -r '.[].result.hits[] | select(.services[].service_name == "HTTP") | .ip' and also how to get only ports jq -r '.[].result.hits[].services[] | select(.service_name == "HTTP") | .port', but I do not understand how to combine it properly in one command. Could someone please point to a right direction?

Answer 1

Save the IP in a variable, and make your selection one level deeper. Then, print out if it matched:
jq -r '.[].result.hits[] | .ip as $ip | .services[] | select(.service_name == "HTTP") | "\($ip):\(.port)"'
2.14.11.41:80
2.14.11.41:8001
2.22.22.102:80
2.22.22.102:8001
2.22.22.102:8089
4.54.84.19:443
Demo

Answer 2

With your shown samples and attempts please try following jq code. Concept wise same as already posted answer but a bit different in looping wise. Using -r option to get output in raw format, along with that using select function to check condition on service_name field is HTTP or not.
jq -r '.[].result.hits[] | "\(.ip):\(.services[] | select(.service_name=="HTTP").port)"' file