Moving away from using regex to parse JSON, you can use Jsawk and Underscore-cli to manipulate JSON like Awk or JavaScript.
https://github.com/micha/jsawk/ https://github.com/ddopson/underscore-cli
https://github.com/micha/jsawk/ https://github.com/ddopson/underscore-cli
About the strongest endorsement I can give is that it makes me wish more of my logs were in JSON format, rather than wishing that less were as I always had before.