Python处理Google Workspace API OAuth日志：转换name-value为标准键值对

核心逻辑 #

Google Workspace Reports API 返回的活动日志中，events 数组下的 parameters 字段统一采用 name + 类型化值键的结构存储参数，转换逻辑如下：

• 遍历所有事件条目下的参数列表
• 提取每个参数的 name 值作为标准键名
• 自动识别参数值对应的类型键（通用值value、整型intValue、布尔型boolValue等），做对应类型转换后作为键值
• 重组为标准键值对结构替换原参数列表即可

完整代码 #

import json
from typing import Any, Dict

# 匹配Google API常用的类型值键，配置对应类型转换规则
TYPE_VALUE_MAPPING = {
    "value": str,
    "intValue": int,
    "longValue": int,
    "boolValue": lambda v: v.lower() == "true",
    "multiValue": list,
    "messageValue": dict
}

def convert_gworkspace_log(raw_log: Dict[str, Any]) -> Dict[str, Any]:
    # 深拷贝原始数据，避免修改输入对象
    processed = json.loads(json.dumps(raw_log))

    # 处理所有事件下的参数字段
    events = processed.get("events", [])
    for event in events:
        params = event.get("parameters", [])
        if not isinstance(params, list):
            continue
        formatted_params = {}
        for param in params:
            param_name = param.get("name")
            if not param_name:
                continue
            # 匹配对应类型的值，做类型转换
            param_val = None
            for val_key, converter in TYPE_VALUE_MAPPING.items():
                if val_key in param:
                    try:
                        param_val = converter(param[val_key])
                    except (ValueError, TypeError):
                        param_val = param[val_key]
                    break
            formatted_params[param_name] = param_val
        # 替换原parameters为标准键值对结构
        event["parameters"] = formatted_params
        # 若需要将参数直接平铺到事件层级，注释上面一行，启用下面两行代码
        # event.update(formatted_params)
        # del event["parameters"]
    return processed

# 样例测试
if __name__ == "__main__":
    raw_log_str = '''{"kind": "admin#reports#activity", "id": {"time": "2022-07-13T11:45:59.181Z", "uniqueQualifier": "<redacted>", "applicationName": "token", "customerId": "<redacted>"}, "etag": "<redacted>", "actor": {"email": "<redacted>", "profileId": "<redacted>"}, "ipAddress": "<redacted>", "events": [{"type": "auth", "name": "activity", "parameters": [{"name": "api_name", "value": "caldav"}, {"name": "method_name", "value": "caldav.calendars.report"}, {"name": "client_id", "value": "<redacted>"}, {"name": "num_response_bytes", "intValue": "165416"}, {"name": "product_bucket", "value": "CALENDAR"}, {"name": "app_name", "value": "<redacted>"}, {"name": "client_type", "value": "<redacted>"}]}]}'''
    raw_data = json.loads(raw_log_str)
    result = convert_gworkspace_log(raw_data)
    print(json.dumps(result, indent=2, ensure_ascii=False))

转换效果 #

样例日志转换后，parameters 字段会从数组结构变为标准键值对对象，其中num_response_bytes这类整型字段会自动转为数字类型，不会保留字符串格式：

"parameters": {
  "api_name": "caldav",
  "method_name": "caldav.calendars.report",
  "client_id": "<redacted>",
  "num_response_bytes": 165416,
  "product_bucket": "CALENDAR",
  "app_name": "<redacted>",
  "client_type": "<redacted>"
}

自定义调整 #

• 若后续API返回新增其他类型值键（比如floatValue），直接在TYPE_VALUE_MAPPING字典中添加对应键和转换函数即可
• 若不需要保留parameters嵌套层级，按照代码注释修改即可将所有参数直接平铺到事件对象下
• 若日志其他层级也存在同类name-value结构，参照events的遍历逻辑添加对应处理路径即可

内容的提问来源于stack exchange，提问作者silentsentinel