You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If you are using osquery to ingest data into a data platform downstream you likely also are building data models as well. There is a problem where the schema will state that a datatype is an integer, but the JSON output is really a blank string ("") and this means it is more labor to data model down stream.
You cannot type cast a blank string into an integer, so to use this data we are stuck in a position where we must boilerplate each select with a nullif statement. This would be a quality of life upgrade for osquery users that stream the query results into large data platforms
What new feature do you want?
For data types to be more defined in the JSON output of query results and use Nulls for blank strings
How is this new feature useful?
This will be useful for anyone who ships osquery data to a data platform, and would lower the amount of code as labor to boilerplate nullifs around every blank string that is actually defined in schema as something else
How can this be implemented?
I guess whatever part of the code base outputs to JSON, could perhaps just sanitize the output a bit better and do some checking if something is an integer and it has no return then it should be a null data type over a blank string
The text was updated successfully, but these errors were encountered:
Feature request
If you are using osquery to ingest data into a data platform downstream you likely also are building data models as well. There is a problem where the schema will state that a datatype is an integer, but the JSON output is really a blank string (
""
) and this means it is more labor to data model down stream.You cannot type cast a blank string into an integer, so to use this data we are stuck in a position where we must boilerplate each
select
with anullif
statement. This would be a quality of life upgrade for osquery users that stream the query results into large data platformsWhat new feature do you want?
For data types to be more defined in the JSON output of query results and use Nulls for blank strings
How is this new feature useful?
This will be useful for anyone who ships osquery data to a data platform, and would lower the amount of code as labor to boilerplate nullifs around every blank string that is actually defined in schema as something else
How can this be implemented?
I guess whatever part of the code base outputs to JSON, could perhaps just sanitize the output a bit better and do some checking if something is an integer and it has no return then it should be a null data type over a blank string
The text was updated successfully, but these errors were encountered: