# Ssh-audit output and json\_query()

**URL:** <https://forum.ansible.com/t/ssh-audit-output-and-json-query/41380>\
**Category:** Get Help\
**Tags:** jmespath\
**Created:** [March 27, 2025, 6:05pm UTC](https://forum.ansible.com/t/ssh-audit-output-and-json-query/41380 "2025-03-27T18:05:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DengelFred](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@DengelFred](https://forum.ansible.com/u/DengelFred)\
**Post date:** [March 27, 2025, 6:05pm UTC](https://forum.ansible.com/t/ssh-audit-output-and-json-query/41380/1 "2025-03-27T18:05:51Z")

</div>

Hello,

I would like to parse the output of ssh-audit -j automatically.  
The output looks like this (shortened):

```json
{
  "kex": [
    {
      "algorithm": "sntrup761x25519-sha512",
      "notes": {
        "info": [
          "default key exchange since OpenSSH 9.9",
          "hybrid key exchange based on post-quantum resistant algorithm and proven conventional X25519 algorithm",
          "available since OpenSSH 9.9"
        ]
      }
    },
    {
      "algorithm": "ecdh-sha2-nistp256",
      "notes": {
        "fail": [
          "using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency"
        ],
        "info": [
          "available since OpenSSH 5.7, Dropbear SSH 2013.62"
        ]
      }
    },
    {
      "algorithm": "diffie-hellman-group14-sha256",
      "notes": {
        "info": [
          "available since OpenSSH 7.3, Dropbear SSH 2016.73"
        ],
        "warn": [
          "2048-bit modulus only provides 112-bits of symmetric strength"
        ]
      }
    }
  ]
}

```

Now, I can query all algos with:

```yaml
kex_avail: "{{ ssh_test_result.stdout | from_json | json_query('kex[].algorithm') }}"

```

but how can I exclude all elements with `notes.fail` and `notes.warn` in it?  
I have a working solution, but I wondering if this is possible in one line 😉

```yaml
- name: Print results
  vars:
    kex_avail: "{{ ssh_test_result.stdout | from_json | json_query('kex[].algorithm') }}"
    kex_crit: "{{ ssh_test_result.stdout | from_json | json_query('recommendations.critical.del.kex[].name') }}"
    kex_warn: "{{ ssh_test_result.stdout | from_json | json_query('recommendations.warning.del.kex[].name') }}"
  ansible.builtin.set_fact:
    kex_use: "{{ kex_avail | community.general.lists_symmetric_difference(kex_crit, kex_warn) }}"

```

Thanks a lot!  
Thomas

---

<div class="post-metadata">

**Author:** ![DengelFred](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@DengelFred](https://forum.ansible.com/u/DengelFred)\
**Post date:** [March 27, 2025, 7:24pm UTC](https://forum.ansible.com/t/ssh-audit-output-and-json-query/41380/2 "2025-03-27T19:24:44Z")

</div>

Ha, got it working 🤣

```yaml
    - name: Calculate good algos (kex)
      vars:
        kex_query: "kex[?notes.warn==null && notes.fail==null].algorithm"
      ansible.builtin.debug:
        msg: "{{ ssh_test_result.stdout | from_json | json_query(kex_query) }}"

```