Skip to main content
Ent+
This feature is available as an add-on for the Honeycomb Enterprise plan. Please contact your Honeycomb account team for details.

​
Description

The Parse with Regex Processor is designed to extract and transform telemetry data—including logs, metrics, and traces—using regular expressions (regex) with named capture groups. This enables users to define specific regex patterns with named capture groups to parse and reformat data from different source fields, enhancing data analysis and insights.

​
Use

This processor is invaluable when users need to extract and categorize specific elements from unstructured or semi-structured data. Users can employ regex patterns with named capture groups to classify extracted data, making it easily identifiable and accessible for further analysis, monitoring, or alerting.

​
Configuration

​
Example Configurations

​
Extract Error Codes from Log Messages

In this example, the Parse with Regex Processor is configured to extract error codes embedded within log messages. Given the unstructured nature of these messages, the use of a regex pattern with a named capture group is crucial for efficient extraction and categorization. Honeycomb Docs - Parse with Regex - image 1 Here is a sample log entry divided into body and attributes: Body:
Attributes:
The objective is to extract the error code “ER1023” and assign it to a new attribute for enhanced analysis. The configuration for the Parse with Regex Processor is as follows:
  • Condition: "body contains 'ErrorCode:'"
  • Source Field Type: Body
  • Source Field: message
  • Target Field Type: Attribute
  • Regex Pattern: "ErrorCode: (?P<errorCode>\w+)"
With this setup, the named capture group “errorCode” is employed to categorize the extracted error code. The processed log entry would appear with an updated attributes section as follows: Attributes After Processing:
Now, the error code is not only extracted but also categorized under the “errorCode” attribute, facilitating effortless filtering and analysis. This structured format allows for precise monitoring and troubleshooting, especially when dealing with specific error codes.