# extractAll

This action extracts all matches for the specified regular expression found in the specified field value (a string), copying the results to a new field. The new field is always a list regardless of the number of matches found. If the regular expression contains more than one capture group (subgroup) these will be concatenated together with “ : “ in the result. See the example below.

This function is available for event, alert, and Situation workflows.

The workflow sweep up filter applies to this function.

## Arguments

Workflow Engine function extractAll takes the following arguments:

Name

Required

Type

Description

sourceField

yes

string

The field name (CEvent or workflowContext) to match against.

expression

yes

string

A string representation of the regular expression to use for extraction. This should be double escaped as needed (e.g. \\d and not \d)

targetField

yes

string

The name of the field to write the results to, if no matches were found this will be an empty list ([])

## Example

Suppose you have an extractAll function defined as follows:

• sourceField : custom_info.pets

• expression : my (.*?) is called (.*?)(?:,|$) • targetField : custom_info.petDetails { "sourceField":"custom_info.pets", "expression":"my (.*?) is called (.*?)(?:,|$)",
"targetField":"custom_info.petDetails"
}

Given a custom_info value of::

custom_info : {
pets : "my cat is called Dave, my dog is called Fred, my bird is called Serge"
}

And the following expression with two capture groups:

my (.*?) is called (.*?)(?:,|\$)

The result would be a petDetails with the two capture groups concatenated to a “ : “ separated string.

custom_info : {
pets : "my cat is called Dave, my dog is called Fred, my bird is called Serge",
petDetails : [
"cat : Dave",
"dog : Fred",
"bird : Serge"
]
}