Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
parse_json
Parses an entire file as JSON. See parse_jsonl
where multiple JSON documents are supported.
Column | Type | Description |
---|---|---|
fullkey | text | Same as key in this table. See parse_jsonl where multiple JSON documents are supported. |
key | text | JSON key or array index. |
parent | text | Parent key when keys are nested in the document. |
path | text | Path of the file to read. Required in WHERE clause |
value | text | JSON value |
This table is not a core osquery table. It is included as part of Fleet's agent (fleetd).