JSON: remove nulls and empty strings

[philhagen]

Suggest removing any field that has a null or empty string for a value from the JSON output.

Current:

{
  "PayloadData1": null,
  "PayloadData2": null,
  "PayloadData3": null,
  "PayloadData4": null,
  "PayloadData5": null,
  "PayloadData6": null,
  "UserName": null,
  "RemoteHost": null,
  "ExecutableInfo": null,
  "MapDescription": null,
  "Computer": "Phil-Win10-VM",
  "Payload": "{\"EventData\":{\"Data\":\"‎Tuesday, ‎April ‎16, ‎2019 6:23:36 PM\",\"Binary\":\"\"}}",
  "UserId": "",
  "Channel": "Application",
  "Provider": "Microsoft-Windows-CAPI2",
  "EventId": 4111,
  "EventRecordId": "41651",
  "ProcessId": 1384,
  "ThreadId": 1888,
  "Level": 4,
  "SourceFile": "C:\\Windows\\System32\\winevt\\Logs\\Application.evtx",
  "TimeCreated": "2019-05-04T05:53:31.0651977+00:00",
  "RecordNumber": 41651
}

Suggested:

{
  "Computer": "Phil-Win10-VM",
  "Payload": "{\"EventData\":{\"Data\":\"‎Tuesday, ‎April ‎16, ‎2019 6:23:36 PM\",\"Binary\":\"\"}}",
  "Channel": "Application",
  "Provider": "Microsoft-Windows-CAPI2",
  "EventId": 4111,
  "EventRecordId": "41651",
  "ProcessId": 1384,
  "ThreadId": 1888,
  "Level": 4,
  "SourceFile": "C:\\Windows\\System32\\winevt\\Logs\\Application.evtx",
  "TimeCreated": "2019-05-04T05:53:31.0651977+00:00",
  "RecordNumber": 41651
}

[EricZimmerman]

sample files sent. please let me know

[EricZimmerman]

closing this as it should be done, but if not, we can reopen