extract()
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Get a match for a regular expression from a source string.
Optionally, convert the extracted substring to the indicated type.
Syntax
extract(regex, captureGroup, source [, typeLiteral])
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| regex | string |
✔️ | A regular expression. |
| captureGroup | int |
✔️ | The capture group to extract. 0 stands for the entire match, 1 for the value matched by the first '('parenthesis')' in the regular expression, and 2 or more for subsequent parentheses. |
| source | string |
✔️ | The string to search. |
| typeLiteral | string |
If provided, the extracted substring is converted to this type. For example, typeof(long). |
Returns
If regex finds a match in source: the substring matched against the indicated capture group captureGroup, optionally converted to typeLiteral.
If there's no match, or the type conversion fails: null.
Examples
The example string Trace is searched for a definition for Duration.
The match is converted to real, then multiplied it by a time constant (1s) so that Duration is of type timespan. In this example, it's equal to 123.45 seconds:
T
| extend Trace="A=1, B=2, Duration=123.45, ..."
| extend Duration = extract("Duration=([0-9.]+)", 1, Trace, typeof(real)) * time(1s)
This example is equivalent to substring(Text, 2, 4):
extract("^.{2,2}(.{4,4})", 1, Text)