Extract

Extract (extract)

Extract fields from text using regular expressions.

Transform json

Minimal example

actions:
  - extract:
      pattern: ""

JSON

{
  "actions": [
    {
      "extract": {
        "pattern": ""
      }
    }
  ]
}

Contents

• Minimal example

• General

• Input

• Mapping

• Output

• Pattern

• Substitution

• Warnings

• Schema

General

General

Field	Type	Required	Description
description	string		describe this step.
condition	lua-expression (string)		Only run this action if the specified condition is met. Examples: 2 * count()

Input

Input

Field	Type	Required	Description
input-field	field (string)		The field containing the text. Default: _raw Examples: data_field

Mapping

Mapping

Field	Type	Required	Description
output-fields	string[]		field names to match with each matched group.
convert	map (string)		Optionally convert these fields afterwards. If fields is omitted, the keys from convert are used as the extracted field names.

Output

Output

Field	Type	Required	Description
remove ✓	boolean (bool)		Remove field containing text afterwards. Default: false

Pattern

Pattern

Field	Type	Required	Description
pattern	regex (string)	✅	Pattern containing named groups. Default is to use the group names. Examples: \d+[A-Z]*

Substitution

Substitution

Field	Type	Required	Description
output-pattern	string		Optionally, do a substitution using text containing $1, $2, etc. referring to captured groups.
output-field	field (string)		Write to this field if doing a substitution. Examples: data_field

Warnings

Warnings

Field	Type	Required	Description
suppress-warnings ✓	boolean (bool)		Suppress warnings generated by this action. Default: false
drop ✓	boolean (bool)		Don’t pass through failed matches. Default: false

Schema

• Convert Table

Convert Table

Field	Type
event.field	str

Key format: field.