Merge results of Redis lookup back into JSON

Questions
1

Describe the problem/error/question

Trying to merge data fetched from Redis back into original JSON

I don’t see a way to customize the output (do a mini-merge) in the Redis node and I can’t figure out a way to use a Merge node at the tail end.

I started working on a Code node, but feel like there must be a better way.

workflow

desired output

End result should look something like this (where context is what I fetched from Redis):

      {
        "event": {
          "_sig": "crowdstrike:alert:idp-session-source-user-endpoint-target-info:anomalousnewserveraccess",
          "_status": "new",
          "src":{
              "val":"10.99.6.99", 
              "context":  {
            "os_version": "NetScaler NS13.1: Build 59.19.nc, Date: Jun 18 2025, 16:36:16   (64-bit)",
            "description": "NetScaler VIP",
            "nt_host": "xyz_VIP_E1 91",
            "category": "loadbalancer"
          }
2

Hey, can you check if the example here used to combine items will help?

3

You can do this by using a set node. To create objects just like you would in a code block, just use dot notation like `object.subObject.param` etc

4

Thank you, @Wouter_Nigrini and @krisn0x. Both of those seem like good approaches but as I got further into the details, I realized I need the code node. I have a variable number of fields to merge so the loop seemed like the best approach in the end.

// The original alert after IP address enrichment - MUST ONLY BE ONE ALERT SENT TO THIS WORKFLOW
let alert = $('Process IP Address Fields').first().json

// Iterate over any fields we've been able to enrich via redis lookups
const redisResults = $input.all()
for (const item of redisResults) {

  const eventField = item.json.field

  // Add an additional field with _ prefix. JIRA workflow will look for this fieldname format and add to issue
  const contextField = "_" + eventField
  alert.event[contextField] = item.json.data
}

return alert
5

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.