Deployment & Ops

Regex Extract and Regex Filter in Cribl Stream

The two regex functions, when each is the right tool, and the patterns the docs recommend.

February 03, 2026
8 min read

Regex Extract

The Regex Extract Function in Cribl Stream "uses regex capture groups to pull structured data out of raw event strings." The page lists three uses: structure raw logs into fields like a timestamp or severity level; extract key-value pairs into separate fields, which can automate key-value discovery; and clean and reduce data by isolating the important parts of a log message. The Function uses the JavaScript (ECMAScript) regex engine.

The page documents the processing in six numbered steps. At the core: the Function ingests the event from the Source field and converts it to a string before applying the regex, so 42 becomes "42". The default Source field is _raw. It then evaluates each configured pattern against the string, up to the Max exec limit (default 100), creating a field per match: a named capture group becomes the field name and the captured text its value, while the _NAME_N and _VALUE_N tokens pair a name with its value, so user=john with the pattern (?<_NAME_1>\w+)=(?<_VALUE_1>\w+) creates user: "john".

The configuration modal carries the standard Function settings:

Two additional settings tune the loop. Max exec is "the maximum number of times the regex pattern should loop through the source field to find matches" and defaults to 100; named groups always execute once, and iterative groups extract up to the limit. Field name format expression is a JavaScript expression that prefixes or suffixes names generated by _NAME_N groups, such as pre_${name} or ${name}_pre. Left blank, Stream "automatically sanitizes names by removing invalid characters (such as spaces or special symbols) to ensure they are valid JavaScript identifiers."

The optional regex flags impact matching. The global flag g causes Cribl Stream to "continue checking the rest of the string after any match," and if multiple matches happen, "the resulting field will contain an array of matches." The other flags operate as standard in the ECMAScript regex library:

The usage examples start by promoting one value from a noisy key-value line. The sample event:

{
   "_raw": "metric1=23, metric2=42, dc=23, abc=xyz"
}

To extract only the metric1 field, the page's regex is metric1=(?<metric1>\d+), and the result:

{
  "_raw": "metric1=23, metric2=42, dc=23, abc=xyz",
  "metric1": "23"
}

The next example isolates a date from a larger string, which the page calls the most common method for structuring specific parts of an event when you know the exact format of the data:

{
  "_raw": "<134>1 2025-07-28T14:30:15Z host-01 conn_id=992 message=\"Connection accepted\""
}

With the regex (?<timestamp>\d{4}-\d{2}-\d{2}), the Function finds the pattern within the _raw event and creates a timestamp field with the value 2025-07-28. The regex only looks for the date; the rest of the event remains intact.

For a predictable format, the page shows a full schema pattern that anchors the line with ^ and $ and maps every segment of the log to a named capture group. Verbatim:

^(?<container_id>[^\s]+)\[(?<process_id>\d+)\]:\s+(?<remote_host>[^\s]+)\s+(?<remote_user>-)\s+(?<auth_user>-)\s+\[(?<timestamp>[^\]]+)\]\s+"(?<request_method>\w+)\s+(?<requested_url>[^\s]+)\s+(?<http_version>[^"]+)"\s+(?<status>\d+)\s+(?<bytes>.+)$

Key-value discovery covers high-volume logs, like firewall or proxy data, where the number and order of fields vary from event to event. Instead of a massive regex, the page extracts every pair it finds with iterative capture groups, then uses a Field name format expression to transform the discovered keys (such as appending a suffix):

Regex:  (?<_NAME_0>[\w-]+)="?(?<_VALUE_0>(?<=")[^"]*|\S*)
Field Name Format Expression: ${name}_XX

For complex logs like Check Point, where the data you need is encapsulated within a header, the page recommends a two-stage approach: isolate the bracketed payload into a temporary, internal field, then extract the individual key-value pairs from that field:

Step 1:
  Regex:  \[(?<__fields>.*)\]
  Source: _raw

Step 2:
  Regex:  (?<_NAME_0>[^ :]+):(?<_VALUE_0>[^;]+);
  Source: __fields

Regex Filter

The Regex Filter Function uses the same engine for an opposite job: it "filters out events based on regex matches." As on the Extract page, the flavor note holds: the Function uses the JavaScript (ECMAScript) regex engine, so test patterns in external tools such as Regex101 with the ECMAScript (JavaScript) flavor.

The configuration surface is short:

The Usage section documents one behavior: the events that match the regex are filtered out. The page does not document a separate match-and-keep mode. For a usage example, it points to the Regex Filtering use case.

Choosing between them

Both Functions work from a field that defaults to _raw, support nested addressing, and carry the same shared settings: Filter (default true), Description, Final (default off), and Additional regex. Both evaluate ECMAScript patterns, so the difference is what happens to the event after a match.

One asymmetry: the Extract Function's Regex must contain named capturing groups, while the Filter Function's Regex is simply a regex to test against. A pattern written for Extract works as a filter pattern; a bare filter pattern does not, on its own, satisfy Extract's named-group requirement.

What the docs flag

The Extract page keeps a dedicated Considerations list, and the Filter page repeats the engine note. The caveats worth keeping in view:

Frequently asked questions

What does the Cribl Stream Regex Extract Function do?

It uses regex capture groups to pull structured data out of raw event strings. Named capture groups make the group name the field name and the captured text the value, and the _NAME_N and _VALUE_N groups extract key-value pairs dynamically. The event comes back with the new fields added to the top.

Which field do Regex Extract and Regex Filter test by default in Cribl Stream?

Both default to the _raw field, and the field supports nested addressing. If the Source field on Regex Extract is left blank, the Function will silently fail.

How does key-value discovery work in the Cribl Stream Regex Extract Function?

The _NAME_N and _VALUE_N capture groups extract pairs dynamically. The text captured by _NAME_N becomes the field name, and the text captured by _VALUE_N becomes the corresponding value. For an event containing user=john, the docs show a pair creating a field called user with the value john.

What does the Cribl Stream Regex Filter Function do?

It filters out events based on regex matches. You set the regex to test against and the field to test, and the field defaults to _raw. The page points to the Regex Filtering use case for a usage example.

Source

Verified against Cribl Stream 4.20 documentation on February 03, 2026.