How do I list the events if there are more than 1 item in array?

[graziaedu]

how do i list the events that in an array has more than 1 item?

1) a:[ {"data1":"abc"},{"data1":"def"}]

2) a:[ {"data1":"abc"}]

3) a:[ {"data1":"abc"},{"data1":"def"}]

4) a:[ {"data1":"abc"}]

i want to list only events 1 and 3.

[richgalloway]

The first step is to find the elements in the array.  I like to use rex for that.

| rex max_match=0 "(?<element>\{[^\}]+})"

The max_match option tells rex to collect all matching strings rather than just the first.  I multi-value field will hold each match.  Next we just need to count the number of matches and filter out the singletons.

| eval elementCount = mvcount(element)
| where elementCount > 1

[bowesmana]

See this example

| makeresults 
| eval _raw="{\"a\":[ {\"data1\":\"abc\"},{\"data1\":\"def\"}]}
{\"a\":[ {\"data1\":\"abc\"}]}
{\"a\":[ {\"data1\":\"abc\"},{\"data1\":\"def\"}]}
{\"a\":[ {\"data1\":\"abc\"}]}"
| multikv noheader=t
| fields _raw 
| fields - _time
``` Above sets up your example data ```
| spath input=_raw
``` Assuming you now have validly parsed JSON - use mvcount() ```
| where mvcount('a{}.data1')>1