RegEx Search Field Expression Plugin
The RegEx plugin runs a regular expression on the message body of a Log Event and returns every whole match as a Search Field value. Use it when the matched text itself is the value you want, in XML, JSON, flat file, or any other text format.
- ✅ Works on any text format in the message body
- ✅ Returns every match, with duplicates collapsed
- ✅ Returns the whole match, even when the pattern contains capturing groups
When to use it
Four RegEx plugins cover the combinations of where the text is and what part of the match you want. For every plugin, see Choose a plugin.
| Your data | You want | Use |
|---|---|---|
| Message body | The whole match | RegEx (this page) |
| Message body | Only the part inside a capturing group ( ) |
RegEx with capturing groups |
| One context value (you know the key) | The whole match | RegEx on Message Context |
| One context value (you know the key) | Only the part inside a capturing group | RegEx on Message Context with capturing groups |
| One context value (you know the key) | The value as it is, no pattern | Message Context Key |
| XML body, pattern on a selected node only | The match within that node | XPath with RegEx |
| A match you need to transform or combine | Nested functions | Formula with regex or regexGroup |
Expression syntax
Select RegEx in the Type list and enter the pattern in the Expression field. The plugin has no other settings.
The RegEx plugin and its siblings in the Type list.
- The plugin returns every match in the message body; Search Fields keep unique values only (see How expressions run).
- The result is always the whole match. Parentheses in the pattern don't change that:
CityId="([0-9]+)"returnsCityId="054", not054. To return only the group, use RegEx with capturing groups. - Matching ignores case: the pattern
cityIdmatchesCityIdin Example 1. - Spaces in the pattern are ignored, and
#starts a comment:a bmatchesab, nota b. Write a literal space as\sor[ ], and a literal#as\#. - Each value is trimmed of leading and trailing white space, and an empty match is dropped.
- A pattern may run for 30 seconds per event at most.
- When nothing matches, Test Expression reports Processed with warning: The Expression yields no result.
Test result when the pattern matches nothing in the message body.
Animated walkthrough: the sibling plugin RegEx with capturing groups returns only group 1 (northwind.example.com); the RegEx plugin would return the whole address orders@northwind.example.com.
Configure and test the expression as described in Add or manage Search Field and Test Your Expression.
Examples
Example 1: Extract city attributes from an order message
Input
<ns0:Orders xmlns:ns0="Common.Schemas/Nodinite/1.0">
<Order>
<Id>101</Id>
<Amount>1337</Amount>
<City CityId="054">Karlstad</City>
</Order>
<Order>
<Id>102</Id>
<Amount>10</Amount>
<City CityId="08">Stockholm</City>
</Order>
</ns0:Orders>
Expression
cityId="([0-9]+)"
Result
CityId="054"
CityId="08"
The pattern contains a capturing group, but the RegEx plugin still returns the whole match. To get 054 and 08, use the same pattern with RegEx with capturing groups.
Test Expression: two unique whole matches from the Orders message. The first City line is blurred in the screenshot; it is the same as in the input above.
Example 2: Extract invoice numbers from a JSON message
Input
{
"invoices": [
{ "invoiceNo": "INV-2026-0042", "amount": 1250.00 },
{ "invoiceNo": "INV-2026-0043", "amount": 89.50 }
]
}
Expression
INV-\d{4}-\d{4}
Result
INV-2026-0042
INV-2026-0043
The pattern describes the whole value, so the whole match is exactly the invoice number.
The pattern matches each invoiceNo value in the JSON body.
Limitations
- The plugin reads the whole message body; for large XML or JSON payloads, prefer XPath or JSON Path.
- It returns whole matches only. Use RegEx with capturing groups to return part of a match.