Crib LogStream - Docs

Getting started with Cribl LogStream

Questions? We'd love to help you! Meet us in #cribl (sign up)
Download manual as PDF - v2.1

    Docs Home

Regex Extract


The Regex Extract function extract fields with regex named groups. (In Splunk these will be index-time fields). Fields that start with __ (double underscore) are special fields in Cribl LogStream. They are ephemeral and can be used by any function downstream but will not be added to events and will not exit the pipeline.


Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.
Description: Simple description about this function. Defaults to empty.
Final: If true, stops data from being fed to the downstream functions. Defaults to No.

Regex: Regex literal with named capturing groups, e.g. (?<foo>bar) or special _NAME_N and _VALUE_N capturing groups which extract both name and value of a field e.g., (?<_NAME_0>[^\s=]+)=(?<_VALUE_0>[^\s]+). Defaults to empty. See Examples below.
Source Field: Field where to perform regex field extraction. Nested addressing supported. Defaults to _raw.

Advanced Settings:

  • Max Exec: The maximum number of times to apply the Regex to source field, used by _NAME_N and _VALUE_N capturing groups. Named capturing groups will always use a value of 1. Defaults to 100.
  • Field Name Format Expression: Expression to format field names when NAME capturing groups are used. The original field name is in global name. E.g., to append XX to all field names: `${name}_XX` . If not specified names will be sanitized using regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g.


Assume a simple event that looks like this: metric1=23 metric2=42 dc=23 abc=xyz

  1. Extract only the metric1 field:
    Regex: metric1=(?<metric1>\d+)
    Result: metric1:"23"
  2. Extract all k=v pairs:
    Regex: (?<_NAME_0>[^\s]+)=(?<_VALUE_0>[^\s]+)
    Result: metric1:"23", metric2:"42", dc"23", abc:"xyz"

Updated 2 months ago

Regex Extract

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.