osquery/osquery

JSON output to support null data types

Opened this issue · 0 comments

Feature request

If you are using osquery to ingest data into a data platform downstream you likely also are building data models as well. There is a problem where the schema will state that a datatype is an integer, but the JSON output is really a blank string ("") and this means it is more labor to data model down stream.

You cannot type cast a blank string into an integer, so to use this data we are stuck in a position where we must boilerplate each select with a nullif statement. This would be a quality of life upgrade for osquery users that stream the query results into large data platforms

What new feature do you want?

For data types to be more defined in the JSON output of query results and use Nulls for blank strings

How is this new feature useful?

This will be useful for anyone who ships osquery data to a data platform, and would lower the amount of code as labor to boilerplate nullifs around every blank string that is actually defined in schema as something else

How can this be implemented?

I guess whatever part of the code base outputs to JSON, could perhaps just sanitize the output a bit better and do some checking if something is an integer and it has no return then it should be a null data type over a blank string