Tools Practical By Samson Tanimawo, PhD Published May 21, 2026 4 min read

jq Power User Cheatsheet

jq for incident response. The expressions that save time.

Filter

.[] | select(.status == "error") | .id finds error IDs.

Faster than grep for JSON.

group_by(.service) | map({service: .[0].service, count: length}) groups by service.

Aggregations without sed/awk.

{a: .x, b: .y | tonumber} reshapes data.

Pipeable; chains nicely.