extract()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Get a match for a regular expression from a source string.

Optionally, convert the extracted substring to the indicated type.

Syntax

extract(regex, captureGroup, source [, typeLiteral])

Learn more about syntax conventions.

Parameters

Name Type Required Description
regex string ✔️ A regular expression.
captureGroup int ✔️ The capture group to extract. 0 stands for the entire match, 1 for the value matched by the first '('parenthesis')' in the regular expression, and 2 or more for subsequent parentheses.
source string ✔️ The string to search.
typeLiteral string If provided, the extracted substring is converted to this type. For example, typeof(long).

Returns

If regex finds a match in source: the substring matched against the indicated capture group captureGroup, optionally converted to typeLiteral.

If there's no match, or the type conversion fails: null.

Examples

The following example extract the username, email, age from the string. The regular expression are used to extract the information.

Run the query

let _data = datatable(Text: string)
[
"User: James, Email: James@example.com, Age: 29",
"User: David, Age: 35"
];
_data |
extend UserName = extract("User: ([^,]+)", 1, Text),
       EmailId = extract(@"Email: (\S+),", 1, Text),
       Age = extract(@"\d+", 0, Text)

Output

Text UserName EmailId Age
User: James, Email: James@example.com, Age: 29 James James@example.com 29
User: David, Age: 35 David 35

The following example extracts the month from the string Dates and returns a table with the date string and the month as int type.

Run the query

let Dates = datatable(DateString: string)
[
    "15-12-2024",
    "21-07-2023",
    "10-03-2022"
];
Dates
| extend Month = extract(@"-(\d{2})-", 1, DateString, typeof(int))
| project DateString, Month

Output

DateString Month
15-12-2024 12
21-07-2023 7
10-03-2022 3

Related content