How to create a regex to capture 4 different values?

[VijaySrrie]

Hi All,

I need help with regex

{"CreationTime": "2022-06-28T01:55:52", "ExchangeMetaData": {"BCC": [], "CC": ["cat@gmail.com", "ant@gmail.com", "sat@gmail.com", "mat@gmail.com"]

Need to capture values under CC
4 different values to be captured under CC
I tried a regex which is capturing only the first value -->    \"CC\"\:\s\[\"?(?<exchangeCc>(\w?\@?\.?)+)

Else with a different regex it is capturing all 4 values as one single value ---> CC\"\:\s+\[(?<CC>[^\]]+)

Is it possible to capture it as  4 different values?

[isoutamo · Accepted solution]

Hi

maybe not the most preferred version, but you could try this

| makeresults
| eval _raw = "{\"CreationTime\": \"2022-06-28T01:55:52\", \"ExchangeMetaData\": {\"BCC\": [], \"CC\": [\"cat@gmail.com\", \"ant@gmail.com\", \"sat@gmail.com\", \"mat@gmail.com\"]}}"
| rex "CC\"\:\s+\[(?<CC>[^\]]+)"
| rex max_match=0 field=CC "(?<cc>\w+@[^\"]+)+"
| fields - _time _raw

r. Ismo 

[VijaySrrie]

@isoutamo its working, can you please explain below line?

| rex max_match=0 field=CC "(?<cc>\w+@[^\"]+)+"

[isoutamo]

You can use this https://regex101.com/r/juMbja/1 to understand this (and other) better.

Named Capture Group cc (?<cc>\w+@[^\"]+)

\w matches any word character (equivalent to [a-zA-Z0-9_])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
@ matches the character @ with index 6410 (4016 or 1008) literally (case sensitive)Named Capture Group cc (?<cc>\w+@[^\"]+)

\w matches any word character (equivalent to [a-zA-Z0-9_])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
@ matches the character @ with index 6410 (4016 or 1008) literally (case sensitive)

Match a single character not present in the list below [^\"]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)

Match a single character not present in the list below [^\"]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)