Rex field list of strings

[tjdevries]

How do I extract all values from a json file containing a list with multiple strings with rex?

The content of the field contains a list and a variable in stringform. 

The number of items in the list can vary and the length of items also. 

The field is as follows:

"{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}

In sofar, I was able to extract the field name with the following query.

| rex field=field.subfield.body max_match=0 "\"name\"\:\"(?<name>[a-zA-Z]+)\""

Variable 2 is a list with multiple strings and this leaves me puzzled. It's not the expression to recognize the strings in the list, but I'm looking for a way to look inside the list, look for two different patterns and find all items in it. 

Can someone help out?

[yuanliu]

With  structured data like JSON, it is less desirable to use Rex for extraction.  Have you considered spath instead?

| makeresults ``` emulation ```
| eval myfield = "{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}"


| spath input=myfield

[tjdevries]

Not yet but it looks a good approach to look into. 

[richgalloway]

May I suggest extracting the fields with rex and then parsing them in a separate command?  Perhaps this will get you started.

| makeresults | eval _raw="{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}"
```Above just sets up test data```
| rex "variable2\\\":\[(?<variable2>[^\]]+)],\\\"name\\\":\\\"(?<name>[a-zA-Z]+)"
| eval variable2=split(variable2,",")
...

[tjdevries]

I managed to extract one field from the variable2-field. In some cases, it picks-up a 4-character-string, if a 6-character string is not present although I added match=0 to the query. 

The cause looks that the order of the six-character and four-character strings within the list is unsorted. So this makes it more complicated. 

Do you have a suggestion to approach this? 

[richgalloway]

If the data is proper JSON, consider @yuanliu's suggestion and try the spath command.

I'm puzzled a bit by the latest response.  The regex doesn't care about the size of the strings, it just pulls everything from between the square brackets that follow "variable2".  Can you share actual events and search results (sanitized, of course)?