Parse with Regex

Extracts values from a telemetry field using a regular expression with named capture groups, then writes each captured group into the field you target. The pattern uses RE2 syntax (Go's regexp engine), and each named group (?P<name>...) becomes a key in the parsed output.

Supported Telemetry Types

Logs	Metrics	Traces
✓	✓	✓

Select one or more signals. Each selected signal is configured independently with its own regex pattern and source and target fields.

Configuration

Basic Configuration

Selection

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	Yes	Logs	The signals this instance runs on: Logs, Metrics, or Traces. Each selected signal gets its own pattern and fields below.
Condition	OTTL Condition	No	(empty)	Apply the regex only to records that match. Empty runs on every record. Configured per selected signal.

Source and target fields

Parameter	Type	Required	Default	Description
Source Field Type	Enum: Resource, Attribute, Body, Custom	Yes	Body (Logs), Attribute (Metrics, Traces)	Where the source value is read from. Body is logs-only. Custom takes any OTTL path and gives access to the full record.
Source Field	OTTL Field	Yes *	—	The field the regex is applied to. Bracket notation for nested fields. For a Body source, leave empty to apply the regex to the entire body.
Target Field Type	Enum: Resource, Attribute, Body, Custom	Yes	Body (Logs), Attribute (Metrics, Traces)	Where the parsed groups are written. Body is logs-only. Custom gives access to the full record.
Target Field	OTTL Field	No	(empty)	Destination for the parsed groups. Leave empty to merge the parsed groups into the chosen target context (resource, attributes, or body).

* For the Custom field type the Source and Target fields are required and take a full OTTL path. For Resource, Attribute, and Body types, leaving Source Field empty applies the regex to the whole context.

Body is available for Logs only. For Metrics and Traces, the field type options are Resource, Attribute, and Custom.

Pattern

Parameter	Type	Required	Default	Description
Regex Pattern	Code Block	Yes	—	The RE2 regex pattern used to parse the source field. Must contain at least one named capture group (?P<name>...); each group becomes a key written to the target.

Examples

Extract access log fields into attributes

A log body holds an access log line in its message field:

{
  "message": "10.0.0.1 - frank [10/Oct/2026:13:55:36 -0700] \"GET /index.html HTTP/1.1\" 200 2326"
}

Configure the processor with named capture groups to pull each field into its own attribute:

• Choose Telemetry Type: Logs
• Condition: body["message"] != nil
• Source Field Type: Body
• Source Field: message
• Target Field Type: Attribute
• Regex Pattern: ^(?P<client_ip>\S+) \S+ \S+ \[(?P<timestamp>[^\]]+)\] "(?P<method>\S+) (?P<path>\S+) HTTP/(?P<http_version>[\d.]+)" (?P<status>\d+) (?P<bytes>\d+)

Each named capture group becomes an attribute key:

{
  "client_ip": "10.0.0.1",
  "timestamp": "10/Oct/2026:13:55:36 -0700",
  "method": "GET",
  "path": "/index.html",
  "http_version": "1.1",
  "status": "200",
  "bytes": "2326"
}

The capture group name controls the output key, so use clear, stable names. Each additional named group in the pattern produces another key on the target.

Configuration Tips

• The pattern must contain at least one named capture group (?P<name>...). Unnamed groups are not written to the target.
• Patterns use RE2 syntax, not PCRE. RE2 has no backreferences and no lookarounds, so rewrite patterns that rely on them.
• Leave the Target Field empty to merge the captured groups directly into the chosen context (for example, into attributes). Set a Target Field to nest them under a single key.

Troubleshooting

No fields are added to the target

Symptoms: the processor runs but the target gains no parsed keys.

Solutions:

1. Confirm the pattern contains at least one named capture group and actually matches the source text.
2. Verify the Source Field holds the value you expect and the Condition evaluates true.
3. Check that the pattern is valid RE2 (no backreferences or lookarounds).

The whole match is captured but the named groups are missing

Symptoms: a match occurs but the expected per-group keys are absent.

Solutions:

1. Make sure groups are named with (?P<name>...); bare (...) groups are dropped.
2. Confirm each group name is unique within the pattern.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: parse-with-regex
spec:
  type: parse_regex
  parameters:
    - name: telemetry_types
      value:
        - Logs
    - name: log_condition
      value: body["message"] != nil
    - name: log_source_field_type
      value: Body
    - name: log_body_source_field
      value: message
    - name: log_target_field_type
      value: Attribute
    - name: log_regex_pattern
      value: 'ErrorCode: (?P<error_code>\w+)'

Related Resources

• ExtractPatterns — OTTL function reference
• RE2 syntax reference

Bindplane Resources

Chain Parse with Regex with other parsers and enrichers to structure and reshape your telemetry:

• Parse JSON
• Parse Key Value
• Parse Severity
• Parse Timestamp