RegEx on Message Context Search Field Expression Plugin
The RegEx on Message Context plugin reads the value of one named context property of a Log Event and returns every whole match of a regular expression in that value. Use it when the value you want is part of a context property, such as the file name at the end of a full file path.
- ✅ Reads one of the context properties, chosen by its key
- ✅ Returns the whole match; the message body is never read
When to use it
Four RegEx plugins cover the combinations of where the text is and what part of the match you want. For every plugin, see Choose a plugin.
| Your data | You want | Use |
|---|---|---|
| Message body | The whole match | RegEx |
| Message body | Only the part inside a capturing group ( ) |
RegEx with capturing groups |
| One context value (you know the key) | The whole match | RegEx on Message Context (this page) |
| One context value (you know the key) | Only the part inside a capturing group | RegEx on Message Context with capturing groups |
| One context value (you know the key) | The value as it is, no pattern | Message Context Key |
| XML stored in a context value | An XPath result | XPath on Message Context |
Expression syntax
Select RegEx on Message Context in the Type list. The plugin shows two fields:

The RegEx on Message Context plugin in the Type list.
| Field | What goes in it |
|---|---|
| RegEx | The regular expression to run on the context value. The help text under the field ends with "The pattern ignores case and white space: write a space as \s or [ ] and # as \# (an unescaped # starts a comment)." |
| Context key | The key of the context property to read. The key is case-sensitive: filename doesn't find FileName. |
- The result is the whole match. To return only a capturing group, use RegEx on Message Context with capturing groups.
- Matching ignores case. Spaces in the pattern are ignored, and
#starts a comment: write a literal space as\sor[ ], and a literal#as\#. - Each value is trimmed of leading and trailing white space, and an empty match is dropped. A pattern may run for 30 seconds per event at most.
- Write the key exactly as it's logged. BizTalk context properties are logged as namespace#property, for example
http://schemas.microsoft.com/BizTalk/2003/file-properties#ReceivedFileName. - Context properties and the reserved keys are described in Context Options. Properties that the ContextPropertiesFilters System Parameter removes aren't kept, so don't base a Search Field on them.

The plugin's fields with their help texts.
- To test, add the key and its value on the Message Context tab of Test Expression. When the key is missing or nothing matches, the test reports Processed with warning: The Expression yields no result:

Test result when the key is missing or the pattern matches nothing in its value.

Animated walkthrough: the sibling plugin RegEx on Message Context with capturing groups reads the FileName context value of a logged order confirmation and returns group 1, ORD-10009. With this plugin, the same pattern would return the whole match ORD-10009-.
Configure and test the expression as described in Add or manage Search Field and Test Your Expression.
Examples
Example 1: Extract the file name from a file path
Input
| Key | Value |
|---|---|
FileName |
\\nodinitesrv01\ftp\public\INT001\Order\OrderFile_123.xml |
Expression
RegEx:
([^\\]+$)Context key:
FileName
Result
OrderFile_123.xml
[^\\]+$ matches the characters after the last backslash, up to the end of the value.

Test Expression: the file name extracted from the FileName context value on the Message Context tab.
Example 2: Extract the file name that BizTalk received
Input
| Key | Value |
|---|---|
http://schemas.microsoft.com/BizTalk/2003/file-properties#ReceivedFileName |
C:\Integration\In\Orders\PO_4711.xml |
Expression
RegEx:
([^\\]+$)Context key:
http://schemas.microsoft.com/BizTalk/2003/file-properties#ReceivedFileName
Result
PO_4711.xml
To get only the order number 4711, use PO_(\d+)\.xml with RegEx on Message Context with capturing groups.

The pattern keeps everything after the last backslash: the file name.