# Parse with Regex

| Metrics | Logs | Traces | Bindplane Collector |
| ------- | ---- | ------ | ------------------- |
| ✓       | ✓    | ✓      | `v1.36.0`+          |

### Description

The Parse with Regex Processor is designed to extract and transform telemetry data—including logs, metrics, and traces—using regular expressions (regex) with named capture groups. This enables users to define specific regex patterns with named capture groups to parse and reformat data from different source fields, enhancing data analysis and insights.

### Use

This processor is invaluable when users need to extract and categorize specific elements from unstructured or semi-structured data. Users can employ regex patterns with named capture groups to classify extracted data, making it easily identifiable and accessible for further analysis, monitoring, or alerting.

### Configuration

<table><thead><tr><th width="129.5078125">Field</th><th>Description</th></tr></thead><tbody><tr><td>Telemetry Types</td><td>The types of telemetry to apply the processor to.</td></tr><tr><td>Condition</td><td>The condition, expressed in OTTL, that must be met for the processor to be applied. Allows users to apply specific criteria to select the data entries to be processed.</td></tr><tr><td>Source Field Type</td><td>Indicates the type of the source field where the regex will be applied. It can be Resource, Attribute, Body, or Custom for logs; Resource, Attribute, or Custom for metrics and traces.</td></tr><tr><td>Source Field</td><td>Specifies the specific field where the regex is applied, pertinent to the selected Source Field Type.</td></tr><tr><td>Target Field Type</td><td>Indicates the type of the target field where the parsed data will be stored. It can be Resource, Attribute, Body, or Custom for logs; Resource, Attribute, or Custom for metrics and traces.</td></tr><tr><td>Regex Pattern</td><td>The regex pattern with a named capture group used for parsing the data, essential for extracting or transforming specific data elements within the telemetry data.</td></tr></tbody></table>

### Example Configurations

#### Extract Error Codes from Log Messages

In this example, the Parse with Regex Processor is configured to extract error codes embedded within log messages. Given the unstructured nature of these messages, the use of a regex pattern with a named capture group is crucial for efficient extraction and categorization.

<figure><img src="https://1405008107-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgmiOMzBfoNFwmKJFHMcJ%2Fuploads%2Fgit-blob-532fd9268c0bb2273c0a89cfdcc08432443d4a7a%2Fintegrations-processors-parse-with-regex-image-1.png?alt=media" alt="Bindplane docs - Parse with Regex - image 1"><figcaption></figcaption></figure>

Here is a sample log entry divided into body and attributes:

**Body:**

```json
{
  "message": "2023-06-20 14:32:10 Error: An error occurred. ErrorCode: ER1023"
}
```

**Attributes:**

```json
{
  "timestamp": "2023-06-20 14:32:10"
}
```

The objective is to extract the error code "ER1023" and assign it to a new attribute for enhanced analysis. The configuration for the Parse with Regex Processor is as follows:

* Condition: `"body contains 'ErrorCode:'"`
* Source Field Type: `Body`
* Source Field: `message`
* Target Field Type: `Attribute`
* Regex Pattern: `"ErrorCode: (?P<errorCode>\w+)"`

With this setup, the named capture group "errorCode" is employed to categorize the extracted error code. The processed log entry would appear with an updated attributes section as follows:

**Attributes After Processing:**

```json
{
  "timestamp": "2023-06-20 14:32:10",
  "errorCode": "ER1023"
}
```

Now, the error code is not only extracted but also categorized under the "errorCode" attribute, facilitating effortless filtering and analysis. This structured format allows for precise monitoring and troubleshooting, especially when dealing with specific error codes.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.bindplane.com/integrations/processors/parse-with-regex.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.