- 4 minutes to read

What are Search Field Expressions?

A Search Field Expression tells Nodinite how to extract a value from a logged message. The Search Field is what users search for, such as "Order Number"; its expressions extract that value from each Message Type, whatever the format.

  • ✅ Extract the same business value from XML, JSON, EDI, CSV, and flat files
  • ✅ Read from the message body or from context properties
  • ✅ Test against real logged messages before you save

An Order Number can arrive as XML from SAP, as EDI from a supplier, and as JSON from a web shop. Give the "Order Number" Search Field one expression per Message Type, and users find every message for an order with one search, end-to-end.

graph LR subgraph Flow["fa:fa-route Order flow: one Log Event per step"] M1["fa:fa-file-code Order Request<br/>XML"] M2["fa:fa-file-lines Order Confirmation<br/>EDI"] M3["fa:fa-key Order Delivery<br/>context properties"] M4["fa:fa-table Payment<br/>fixed-width flat file"] M5["fa:fa-file-code Payment Confirmation<br/>JSON"] end M1 -->|"XPath"| SF["fa:fa-magnifying-glass-plus Search Field<br/>Order Number"] M2 -->|"RegEx"| SF M3 -->|"Message Context Key"| SF M4 -->|"Flat File Fixed Width"| SF M5 -->|"JSON Path"| SF SF --> LV["fa:fa-hard-drive Log View<br/>one search, every step"] style M1 fill:#2678BD,color:#fff style M2 fill:#2678BD,color:#fff style M3 fill:#2678BD,color:#fff style M4 fill:#2678BD,color:#fff style M5 fill:#2678BD,color:#fff style SF fill:#E47528,color:#fff style LV fill:#93d16d,color:#000

Diagram: each step of the order flow logs a different message format (blue); one expression per Message Type, labelled on the arrow, extracts the same value into the "Order Number" Search Field (orange), so one search in a Log View (green) finds every step.

How expressions run

graph LR A["Log Event<br/>logged"] --> B{"Message Type"} B --> C["Search Field Expressions<br/>for this Message Type"] C --> D["Extracted values"] D --> E["Search Field values<br/>in Log Views"] style A fill:#2678BD,color:#fff style B fill:#FFD525,color:#000 style C fill:#E47528,color:#fff style D fill:#3F827B,color:#fff style E fill:#93d16d,color:#000

Diagram: the Logging Service selects the expressions for the Log Event's Message Type and stores the extracted values on the Search Fields.

  1. A Log Event is logged, or re-indexed, and the Logging Service identifies its Message Type. For EDIFACT messages, the EDIMessageTypeParseString System Parameter builds the Message Type name.
  2. Every Search Field Expression configured for that Message Type, or as Global, runs against the Log Event.
  3. The extracted values are stored on the Search Field and can be searched in Log Views.

What you need to know about every expression, whatever the plugin:

Topic Behavior
Data source An expression reads the message body (payload) or the context properties (key/value metadata such as headers and tracked properties). The Formula plugin can read both, plus Log Event fields, and look up values in SQL Server.
Message Types Each expression applies to the Message Types you select on it. One Search Field typically has one expression per Message Type.
Global A Global expression runs for every Message Type. Use it sparingly: it runs for every logged message.
Optional When checked, finding no value is normal. When unchecked, finding no value is reported as a warning.
Several values An expression can return several values, such as every order number in a batch file. All of them are searchable.
Unique values Duplicates are collapsed. The test bench shows the Number of unique matches.
History New expressions apply to new Log Events. Re-index to apply them to Log Events already logged.
Large bodies A message body larger than the MessageProcessingMaxBodySize System Parameter isn't processed, so body-based expressions extract nothing from it.
Filtered context Context properties that the ContextPropertiesFilters System Parameter removes aren't kept, so don't base context-based expressions on them.
Encoding The body is read in its resolved Character Encoding, the same encoding the wizard's Test step shows.

Set these properties and test your expression on Add or manage Search Field; see Test Your Expression.

Choose a plugin

Pick the plugin by where the value is and what the data looks like. Each plugin page has syntax and worked examples.

Your value is in… Use
XML in the body XPath
XML in the body, but you need only part of the selected text XPath with RegEx
XML that is encoded inside another XML element XPath on Wrapped XPath
XML stored in a context property XPath on Message Context
JSON in the body JSON Path
Any text in the body (EDI, plain text, any format) — the whole match RegEx
Any text in the body — only part of the match RegEx with capturing groups
A context property you know the exact key of Message Context Key
A context property value — the whole match of a pattern RegEx on Message Context
A context property value — only part of the match RegEx on Message Context with capturing groups
Delimited text (CSV, semicolon, pipe) Flat File CSV
Fixed-width records Flat File Fixed Width
Needs combining, transforming, counting, or a SQL lookup Formula

Tip

Prefer the simplest plugin that does the job: a dedicated plugin is easier to read and faster than the same logic in a Formula.

Expression type list in the Search Field Expression editor
The expression plugins available when you add a Search Field Expression.

Best Practices

  • Name Search Fields in business terms ("Order Number") and keep the technical detail in the expressions.
  • Select specific Message Types instead of Global whenever you can.
  • Test every expression with real messages, including edge cases such as missing or empty values, and mark it Optional when the value may legitimately be absent.
  • Keep Formula expressions short; split complex logic over several Search Fields if it gets hard to read.

Next Steps