JSON access logs: jq vs grep/awk

JSON access logs: jq vs grep/awk

More servers now log JSON lines. Your old grep habits need a rethink.

🔗 grep/awk — still fine for a yes/no scan ("does any line contain Googlebot"), and it's faster on huge files since it doesn't parse structure.
🔗 jq — once logs are structured JSON, jq 'select(.user_agent | test("Googlebot")) | .request_uri' is robust where awk's positional $7 breaks the moment field order shifts. Credit to Stephen Dolan's jq.

⭐ Pick of the week: the reliability point from jq's manual — positional parsing silently corrupts when a quoted field contains spaces; key-based jq doesn't.

Takeaway: grep for a quick existence check on JSON logs; jq the moment you extract specific fields and want correctness over raw speed.