class_docstr: JSON record parser
class_docstr_tok: ["JSON","record","parser"]
docstr: Identify and extract nested payloads from parsed JSON records.
  
  Nested payloads can be detected with 'json_path' or 'json_regex_key' option.
  The value of these should be a JMESpath (http://jmespath.org/) compliant search
  expression that returns the desired nested records.
  
  If desired, fields present on the root of the record can be merged into child
  events using the 'envelope_keys' option.
  
  Args:
      data (dict): The raw json data loaded as a dictionary
  
  Returns:
      list<tuple>: List of tuples with records and their parsing status
          Examples: [({'key': 'value'}, True)]
docstr_tok: ["Identify","and","extract","nested","payloads","from","parsed","JSON","records",".","Nested","payloads","can","be","detected","with","'json_path","'","or","'json_regex_key","'","option",".","The","value","of","these","should","be","a","JMESpath","(","http",":","\/\/jmespath.org\/",")","compliant","search","expression","that","returns","the","desired","nested","records",".","If","desired",",","fields","present","on","the","root","of","the","record","can","be","merged","into","child","events","using","the","'envelope_keys","'","option",".","Args",":","data","(","dict",")",":","The","raw","json","data","loaded","as","a","dictionary","Returns",":","list","<","tuple",">",":","List","of","tuples","with","records","and","their","parsing","status","Examples",":","[","(","{","'key","'",":","'value","'","}",",","True",")","]"]
code: def _parse(self, data):
      """Identify and extract nested payloads from parsed JSON records.
  
      Nested payloads can be detected with 'json_path' or 'json_regex_key' option.
      The value of these should be a JMESpath (http://jmespath.org/) compliant search
      expression that returns the desired nested records.
  
      If desired, fields present on the root of the record can be merged into child
      events using the 'envelope_keys' option.
  
      Args:
          data (dict): The raw json data loaded as a dictionary
  
      Returns:
          list<tuple>: List of tuples with records and their parsing status
              Examples: [({'key': 'value'}, True)]
      """
      # TODO (ryandeivert): migrate all of this to the base class and do away with JSONParser
      if not (self._json_path or self.json_regex_key):
          return [(data, True)]  # Nothing special to be done
  
      records = []
      if self._json_path:
          records = self._extract_via_json_path(data)
      elif self.json_regex_key:
          records = self._extract_via_json_regex_key(data)
  
      return records if records else [(data, False)]
  
imports: from abc import ABCMeta, abstractmethod
  from copy import deepcopy
  import csv
  from fnmatch import fnmatch
  import json
  import logging
  import re
  import io
  import jmespath
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 5 for calling the JSONParser obj's underlying member method code with example usage: obj._parse(data) and returns: unknown, list