> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/processors/parse-with-regex.md). # Parse with Regex Extracts values from a telemetry field using a regular expression with named capture groups, then writes each captured group into the field you target. The pattern uses RE2 syntax (Go's `regexp` engine), and each named group `(?P...)` becomes a key in the parsed output. ### Supported Telemetry Types | Logs | Metrics | Traces | | ---- | ------- | ------ | | ✓ | ✓ | ✓ | Select one or more signals. Each selected signal is configured independently with its own regex pattern and source and target fields. ### Configuration #### Basic Configuration
Bindplane docs - Parse with Regex - image 1
**Selection** | Parameter | Type | Required | Default | Description | | --------------------- | ------------------ | -------- | --------- | ------------------------------------------------------------------------------------------------------------------------ | | Choose Telemetry Type | Telemetry Selector | Yes | Logs | The signals this instance runs on: Logs, Metrics, or Traces. Each selected signal gets its own pattern and fields below. | | Condition | OTTL Condition | No | *(empty)* | Apply the regex only to records that match. Empty runs on every record. Configured per selected signal. | **Source and target fields** | Parameter | Type | Required | Default | Description | | ----------------- | --------------------------------------- | -------- | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Source Field Type | Enum: Resource, Attribute, Body, Custom | Yes | Body (Logs), Attribute (Metrics, Traces) | Where the source value is read from. **Body is logs-only.** Custom takes any OTTL path and gives access to the full record. | | Source Field | OTTL Field | Yes \* | — | The field the regex is applied to. Bracket notation for nested fields. For a Body source, leave empty to apply the regex to the entire body. | | Target Field Type | Enum: Resource, Attribute, Body, Custom | Yes | Body (Logs), Attribute (Metrics, Traces) | Where the parsed groups are written. **Body is logs-only.** Custom gives access to the full record. | | Target Field | OTTL Field | No | *(empty)* | Destination for the parsed groups. Leave empty to merge the parsed groups into the chosen target context (resource, attributes, or body). | \* For the **Custom** field type the Source and Target fields are required and take a full OTTL path. For Resource, Attribute, and Body types, leaving Source Field empty applies the regex to the whole context. **Body is available for Logs only.** For Metrics and Traces, the field type options are Resource, Attribute, and Custom. **Pattern** | Parameter | Type | Required | Default | Description | | ------------- | ---------- | -------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Regex Pattern | Code Block | Yes | — | The RE2 regex pattern used to parse the source field. Must contain at least one named capture group `(?P...)`; each group becomes a key written to the target. | ### Examples #### Extract access log fields into attributes
Bindplane docs - Parse with Regex - image 2
A log body holds an access log line in its `message` field: ```json { "message": "10.0.0.1 - frank [10/Oct/2026:13:55:36 -0700] \"GET /index.html HTTP/1.1\" 200 2326" } ``` Configure the processor with named capture groups to pull each field into its own attribute: * Choose Telemetry Type: `Logs` * Condition: `body["message"] != nil` * Source Field Type: `Body` * Source Field: `message` * Target Field Type: `Attribute` * Regex Pattern: `^(?P\S+) \S+ \S+ \[(?P[^\]]+)\] "(?P\S+) (?P\S+) HTTP/(?P[\d.]+)" (?P\d+) (?P\d+)` Each named capture group becomes an attribute key: ```json { "client_ip": "10.0.0.1", "timestamp": "10/Oct/2026:13:55:36 -0700", "method": "GET", "path": "/index.html", "http_version": "1.1", "status": "200", "bytes": "2326" } ``` The capture group name controls the output key, so use clear, stable names. Each additional named group in the pattern produces another key on the target. ### Configuration Tips * The pattern must contain at least one named capture group `(?P...)`. Unnamed groups are not written to the target. * Patterns use RE2 syntax, not PCRE. RE2 has no backreferences and no lookarounds, so rewrite patterns that rely on them. * Leave the Target Field empty to merge the captured groups directly into the chosen context (for example, into attributes). Set a Target Field to nest them under a single key. ### Troubleshooting #### No fields are added to the target Symptoms: the processor runs but the target gains no parsed keys. Solutions: 1. Confirm the pattern contains at least one named capture group and actually matches the source text. 2. Verify the Source Field holds the value you expect and the Condition evaluates true. 3. Check that the pattern is valid RE2 (no backreferences or lookarounds). #### The whole match is captured but the named groups are missing Symptoms: a match occurs but the expected per-group keys are absent. Solutions: 1. Make sure groups are named with `(?P...)`; bare `(...)` groups are dropped. 2. Confirm each group name is unique within the pattern. ### Standalone Processor ```yaml apiVersion: bindplane.observiq.com/v1 kind: Processor metadata: name: parse-with-regex spec: type: parse_regex parameters: - name: telemetry_types value: - Logs - name: log_condition value: body["message"] != nil - name: log_source_field_type value: Body - name: log_body_source_field value: message - name: log_target_field_type value: Attribute - name: log_regex_pattern value: 'ErrorCode: (?P\w+)' ``` ### Related Resources * [ExtractPatterns — OTTL function reference](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/ottl/ottlfuncs/README.md#extractpatterns) * [RE2 syntax reference](https://github.com/google/re2/wiki/Syntax) ### Bindplane Resources Chain Parse with Regex with other parsers and enrichers to structure and reshape your telemetry: * [Parse JSON](/integrations/processors/parse-json.md) * [Parse Key Value](/integrations/processors/parse-key-value.md) * [Parse Severity](/integrations/processors/parse-severity.md) * [Parse Timestamp](https://github.com/observIQ/bindplane-docs/blob/main/docs/integrations/processors/parse-timestamp.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/integrations/processors/parse-with-regex.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.