Getting "Human" (ISO8601) Datetime Stamps From dnsdbq JSON lines-formatted Output

1. Introduction

dnsdbq

is a popular command-line client for accessing DNSDB API.

dnsdbq

can produce output in presentation format, CSV format, or JSON lines format. One issue that users sometimes run into when using the JSON lines format is that timestamps in the JSON lines format are left “raw,” in “Unix epoch seconds.” For example, let’s look at one record from DNSDB for www.reed.edu in JSON lines format:

$ dnsdbq -r www.reed.edu -j -l 1
{"count":897725,"time_first":1277399572,"time_last":1540409659,"rrname":"www.reed.edu.","rrtype":"A","bailiwick":"reed.edu.","rdata":["134.10.2.252"]}


While there’s nothing “wrong” or “improper” about timestamps expressed as Unix epoch seconds, many of us will prefer to convert them to a more easily read format, such as ISO8601 datetime format.

2. jq To The Rescue

jq

is an oft-used tool for post-processing JSON Lines output. In this case, we’ll use

jq

to reformat the Unix epoch second time stamps to ISO8601 dates. There are “many ways to get to the same place” in

jq

, but one solution to this problem is the following succinct transformation

(.time_first |= todate) ? //.

applied to each of the four timefields that can be in

dnsdbq

’s output.

We’ll make this into a

jq

function

rewrite_dates

and save it into the

jq

init file. Create file

~/.jq

(or append to an existing one) containing:

def rewrite_dates:
(.time_first |= todate) ? //.
| (.time_last |= todate) ? //.
| (.zone_time_first |= todate) ? //.
| (.zone_time_last |= todate) ? //.;


Here’s how to use it:

$ dnsdbq -r www.reed.edu -j -l 1 | jq rewrite_dates
{
"count": 898126,
"time_first": "2010-06-24T17:12:52Z",
"time_last": "2018-10-25T19:52:55Z",
"rrname": "www.reed.edu.",
"rrtype": "A",
"bailiwick": "reed.edu.",
"rdata": [
"134.10.2.252"
]
}


3. Conclusion

We hope this article has helped eliminate one potential problem when it comes to using

dnsdbq

, namely the issue of raw Unix epoch-second-format dates in JSON Lines format output. We also hope this article may inspire you to investigate the power of

jq

, and its many cool and useful capabilities.

David Waitzman is a Senior Distributed Systems Engineer for Farsight Security, Inc..