Skip to content
mroot.co
← All writing
Notes / TILJul 1, 2026 · 1 min read

TIL: jq can walk arbitrarily nested JSON with `..`

Recursive descent in jq (`..`) finds a key no matter how deep it is buried — perfect for spelunking a cloud API response you did not write.

I spent too long writing explicit paths to pull one field out of a deeply nested AWS describe-* response. jq already had the answer.

The .. operator does a recursive descent over the whole document. Combine it with select to grab every occurrence of a key regardless of nesting depth:

find every ARN, anywhere in the doc
# every value under any "arn" key, at any depthaws ec2 describe-instances | jq '.. | .arn? // empty'
The `?` is doing real work
.arn? suppresses the error when a node has no .arn, so the recursion does not blow up on scalars. // empty drops the nulls so you only see hits.

It composes with select for conditional matches too — say you only want ARNs belonging to a specific service, buried at any depth:

only ARNs containing a given substring
aws ec2 describe-instances | jq '.. | .arn? // empty | select(contains("ec2"))'

Two minutes saved becomes twenty when you stop hand-writing paths into responses you did not design.

Marc Delacruz — full-stack, security-minded.Get in touch →