Creating nodes and relationships from a map

I have a JSON file that I can read in, I think it returns a map. But I can't figure out how to make nodes and relationships using the map. Is there an easy way/process to read in a map and create all the nodes/relationships?

Check this link:

1 Like

I have looked at this and tried the code, but it doesn't seem to solve the problem. Here is a sample of my data.

[
{
"_index": "packets-2020-11-05",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.interface_id": "0",
"frame.interface_id_tree": {
"frame.interface_name": "ens33"
},
"frame.encap_type": "1",
"frame.time": "Nov 5, 2020 09:56:48.530174711 Central Standard Time",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "1604591808.530174711",
"frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000",
"frame.time_relative": "0.000000000",
"frame.number": "1",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.protocols": "eth:ethertype:ip:udp:data"
},
"eth": {
"eth.dst": "00:50:56:35:b5:3d",
"eth.dst_tree": {
"eth.dst_resolved": "VMware_35:b5:3d",
"eth.dst.oui": "20566",
"eth.dst.oui_resolved": "VMware, Inc.",
"eth.addr": "00:50:56:35:b5:3d",
"eth.addr_resolved": "VMware_35:b5:3d",
"eth.addr.oui": "20566",
"eth.addr.oui_resolved": "VMware, Inc.",
"eth.dst.lg": "0",
"eth.lg": "0",
"eth.dst.ig": "0",
"eth.ig": "0"
},
"eth.src": "00:50:56:c0:00:08",
"eth.src_tree": {
"eth.src_resolved": "VMware_c0:00:08",
"eth.src.oui": "20566",
"eth.src.oui_resolved": "VMware, Inc.",
"eth.addr": "00:50:56:c0:00:08",
"eth.addr_resolved": "VMware_c0:00:08",
"eth.addr.oui": "20566",
"eth.addr.oui_resolved": "VMware, Inc.",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000800",
"eth.padding": "00:00"
},
"ip": {
"ip.version": "4",
"ip.hdr_len": "20",
"ip.dsfield": "0x00000000",
"ip.dsfield_tree": {
"ip.dsfield.dscp": "0",
"ip.dsfield.ecn": "0"
},
"ip.len": "44",
"ip.id": "0x00001268",
"ip.flags": "0x00000000",
"ip.flags_tree": {
"ip.flags.rb": "0",
"ip.flags.df": "0",
"ip.flags.mf": "0"
},
"ip.frag_offset": "0",
"ip.ttl": "128",
"ip.proto": "17",
"ip.checksum": "0x0000742e",
"ip.checksum.status": "2",
"ip.src": "192.168.25.1",
"ip.addr": "192.168.25.1",
"ip.src_host": "192.168.25.1",
"ip.host": "192.168.25.1",
"ip.dst": "192.168.25.217",
"ip.addr": "192.168.25.217",
"ip.dst_host": "192.168.25.217",
"ip.host": "192.168.25.217"
},
"udp": {
"udp.srcport": "56459",
"udp.dstport": "55003",
"udp.port": "56459",
"udp.port": "55003",
"udp.length": "24",
"udp.checksum": "0x0000432b",
"udp.checksum.status": "2",
"udp.stream": "0",
"Timestamps": {
"udp.time_relative": "0.000000000",
"udp.time_delta": "0.000000000"
},
"udp.payload": "33:00:22:00:00:00:00:00:00:00:00:00:00:00:00:00"
},
"data": {
"data.data": "33:00:22:00:00:00:00:00:00:00:00:00:00:00:00:00",
"data.len": "16"
}
}
}
},
{
"_index": "packets-2020-11-05",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.interface_id": "0",
"frame.interface_id_tree": {
"frame.interface_name": "ens33"
},
"frame.encap_type": "1",
"frame.time": "Nov 5, 2020 09:56:48.741082638 Central Standard Time",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "1604591808.741082638",
"frame.time_delta": "0.210907927",
"frame.time_delta_displayed": "0.210907927",
"frame.time_relative": "0.210907927",
"frame.number": "2",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.protocols": "eth:ethertype:ip:udp:data"
},
"eth": {
"eth.dst": "00:50:56:35:b5:3d",
"eth.dst_tree": {
"eth.dst_resolved": "VMware_35:b5:3d",
"eth.dst.oui": "20566",
"eth.dst.oui_resolved": "VMware, Inc.",
"eth.addr": "00:50:56:35:b5:3d",
"eth.addr_resolved": "VMware_35:b5:3d",
"eth.addr.oui": "20566",
"eth.addr.oui_resolved": "VMware, Inc.",
"eth.dst.lg": "0",
"eth.lg": "0",
"eth.dst.ig": "0",
"eth.ig": "0"
},
"eth.src": "00:50:56:c0:00:08",
"eth.src_tree": {
"eth.src_resolved": "VMware_c0:00:08",
"eth.src.oui": "20566",
"eth.src.oui_resolved": "VMware, Inc.",
"eth.addr": "00:50:56:c0:00:08",
"eth.addr_resolved": "VMware_c0:00:08",
"eth.addr.oui": "20566",
"eth.addr.oui_resolved": "VMware, Inc.",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000800",
"eth.padding": "00:00"
},
"ip": {
"ip.version": "4",
"ip.hdr_len": "20",
"ip.dsfield": "0x00000000",
"ip.dsfield_tree": {
"ip.dsfield.dscp": "0",
"ip.dsfield.ecn": "0"
},
"ip.len": "44",
"ip.id": "0x00001269",
"ip.flags": "0x00000000",
"ip.flags_tree": {
"ip.flags.rb": "0",
"ip.flags.df": "0",
"ip.flags.mf": "0"
},
"ip.frag_offset": "0",
"ip.ttl": "128",
"ip.proto": "17",
"ip.checksum": "0x0000742d",
"ip.checksum.status": "2",
"ip.src": "192.168.25.1",
"ip.addr": "192.168.25.1",
"ip.src_host": "192.168.25.1",
"ip.host": "192.168.25.1",
"ip.dst": "192.168.25.217",
"ip.addr": "192.168.25.217",
"ip.dst_host": "192.168.25.217",
"ip.host": "192.168.25.217"
},
"udp": {
"udp.srcport": "56460",
"udp.dstport": "55003",
"udp.port": "56460",
"udp.port": "55003",
"udp.length": "24",
"udp.checksum": "0x0000432a",
"udp.checksum.status": "2",
"udp.stream": "1",
"Timestamps": {
"udp.time_relative": "0.000000000",
"udp.time_delta": "0.000000000"
},
"udp.payload": "33:00:22:00:00:00:00:00:00:00:00:00:00:00:00:00"
},
"data": {
"data.data": "33:00:22:00:00:00:00:00:00:00:00:00:00:00:00:00",
"data.len": "16"
}
}
}
},
{
"_index": "packets-2020-11-05",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.interface_id": "0",
"frame.interface_id_tree": {
"frame.interface_name": "ens33"
},
"frame.encap_type": "1",
"frame.time": "Nov 5, 2020 09:56:48.796652407 Central Standard Time",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "1604591808.796652407",
"frame.time_delta": "0.055569769",
"frame.time_delta_displayed": "0.055569769",
"frame.time_relative": "0.266477696",
"frame.number": "3",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.protocols": "eth:ethertype:ip:udp:data"
},
"eth": {
"eth.dst": "00:50:56:22:c3:a1",
"eth.dst_tree": {
"eth.dst_resolved": "VMware_22:c3:a1",
"eth.dst.oui": "20566",
"eth.dst.oui_resolved": "VMware, Inc.",
"eth.addr": "00:50:56:22:c3:a1",
"eth.addr_resolved": "VMware_22:c3:a1",
"eth.addr.oui": "20566",
"eth.addr.oui_resolved": "VMware, Inc.",
"eth.dst.lg": "0",
"eth.lg": "0",
"eth.dst.ig": "0",
"eth.ig": "0"
},
"eth.src": "00:50:56:c0:00:08",
"eth.src_tree": {
"eth.src_resolved": "VMware_c0:00:08",
"eth.src.oui": "20566",
"eth.src.oui_resolved": "VMware, Inc.",
"eth.addr": "00:50:56:c0:00:08",
"eth.addr_resolved": "VMware_c0:00:08",
"eth.addr.oui": "20566",
"eth.addr.oui_resolved": "VMware, Inc.",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000800",
"eth.padding": "00:00:00:00:00:00:00:00"
},
"ip": {
"ip.version": "4",
"ip.hdr_len": "20",
"ip.dsfield": "0x00000000",
"ip.dsfield_tree": {
"ip.dsfield.dscp": "0",
"ip.dsfield.ecn": "0"
},
"ip.len": "38",
"ip.id": "0x0000a78c",
"ip.flags": "0x00000000",
"ip.flags_tree": {
"ip.flags.rb": "0",
"ip.flags.df": "0",
"ip.flags.mf": "0"
},
"ip.frag_offset": "0",
"ip.ttl": "128",
"ip.proto": "17",
"ip.checksum": "0x0000df12",
"ip.checksum.status": "2",
"ip.src": "192.168.25.1",
"ip.addr": "192.168.25.1",
"ip.src_host": "192.168.25.1",
"ip.host": "192.168.25.1",
"ip.dst": "192.168.25.214",
"ip.addr": "192.168.25.214",
"ip.dst_host": "192.168.25.214",
"ip.host": "192.168.25.214"
},
"udp": {
"udp.srcport": "49251",
"udp.dstport": "49000",
"udp.port": "49251",
"udp.port": "49000",
"udp.length": "18",
"udp.checksum": "0x0000f8df",
"udp.checksum.status": "2",
"udp.stream": "2",
"Timestamps": {
"udp.time_relative": "0.000000000",
"udp.time_delta": "0.000000000"
},
"udp.payload": "2e:2e:7c:0a:0e:02:a5:13:75:a7"
},
"data": {
"data.data": "2e:2e:7c:0a:0e:02:a5:13:75:a7",
"data.len": "10"
}
}
}
}
]

Try this:

CALL apoc.load.json("file:///westfall.json")
YIELD value
UNWIND  value._source as data
RETURN data.layers.eth.`eth.dst_tree`.`eth.addr`
result: "00:50:56:35:b5:3d"

CALL apoc.load.json("file:///westfall.json")
YIELD value
UNWIND  value._source as data
with data.layers.frame as frm
return frm.`frame.time`
result: "Nov 5, 2020 09:56:48.530174711 Central Standard Time"

CALL apoc.load.json("file:///westfall.json")
YIELD value
UNWIND  value._source as data
with data.layers.udp as ud
return ud.`udp.srcport`
result: "56459"

CALL apoc.load.json("file:///westfall.json")
YIELD value
UNWIND  value._source as data
with data.layers.ip as ip
return ip.`ip.src_host`
result: "192.168.25.1"

You must enclose the item name between backtick.
I used your json file.

Cool, thank you. It' s working well. What to do with lists? I want to create objects and set the lists in the data to lists in the node. Do I have to unwind the lists and then set the values?

And thank you again, I do appreciate it.

Yes, for Lists also use UNWIND and rest is same. Thanks for your appreciation!