return full path

[lprat]

Hi, Thanks for you work! I would like extract full path on query. With jq , i can do: $ cat report-cuckoo.json |jq 'path(.. |.file_written?| select(.!=null))' [ "behavior", "generic", 1, "summary", "file_written" ] [ "behavior", "summary", "file_written" ] Is it possible with your tool? Loading JSON document from report-cuckoo.json... done.

$..*[@.file_written] [ [ "C:\Users\cuck\AppData\LocaldsDwSUeGcL.exe", "C:\Users\cuck\AppData\LocalMgyoNizMqk.jpg" ], [ "C:\Users\cuck\AppData\LocaldsDwSUeGcL.exe", "C:\Users\cuck\AppData\LocalMgyoNizMqk.jpg" ] ] I don't found solution.

Thanks for help. Sincerly, Lionel