How to extract badly formatted JSON?

[markangeltruema]

Hi

I'm trying to extract some json values into tables for a dashboard. The log line that i'm using is something like the below

 username=myUser notificationPreferences=
[class NotificationPreferences { category=cat1, categoryDescription=category1  receiveEmailNotifications=false receiveSmsNotifications=false }, 
class NotificationPreferences { category=cat2 categoryDescription=category2 receiveEmailNotifications=false receiveSmsNotifications=true  }] 

As you can see, its just a standard toString on a java class that the developers are outputting. What i want is a table of users and categories, with each category having the associated details, eg

User	Category	Email	SMS
myUser1	Category1	false	false
myUser1	Category2	false	true
myUser2	Category1	true	true

I started by trying to tidy up the json 

| rex field=notificationPreferences mode=sed "s/\[class NotificationPreferences/prefs:[ /g"
| rex field=notificationPreferences mode=sed "s/, class NotificationPreferences/, /g"

Which makes the notificationPreferences field a bit better

 username=myUser notificationPreferences=
prefs:[ { category=cat1, categoryDescription=category1  receiveEmailNotifications=false receiveSmsNotifications=false },{ category=cat2 categoryDescription=category2 receiveEmailNotifications=false receiveSmsNotifications=true  }] 

But from here im struggling with what i need to do in terms of spath and extractions to get both categories to work. I only ever seem to get the first category to appear in my results.

Any help would be great

Thanks

[ITWhisperer]

Given that the example string is so far from properly formatted JSON, you could try something like this

| makeresults 
| eval _raw=" username=myUser notificationPreferences=
[class NotificationPreferences { category=cat1, categoryDescription=category1  receiveEmailNotifications=false receiveSmsNotifications=false }, 
class NotificationPreferences { category=cat2 categoryDescription=category2 receiveEmailNotifications=false receiveSmsNotifications=true  }] "
``` Lines above just set up your sample data ```
| rex "(?ms)notificationPreferences=\s*\[(?<preferences>.*?)\]"
| rex field=preferences max_match=0 "class NotificationPreferences \{\s?(?<preference>.*?)\s?\}"
| mvexpand preference
| rename _raw as orig_raw
| rename preference as _raw
| extract pairdelim=", " kvdelim="="
| rename _raw as preference
| rename orig_raw as _raw