# Extract Substring action

This action extracts one or more substrings from an input field using a regex. Then it copies the substrings to the output fields, in order.

This action is useful for data fields with consistent formats that can be defined in a regex. For data fields that delineate their values using a consistent character string, such as : or :: , you can use the Split action.

This action takes the following inputs:

• Input field

The field to search.

• Regex capture groups

The regex to apply to the input field.

• Output fields

Copy the extracted substrings to these fields, in order.

## Example

One of your event streams has source fields that are formatted as follows:

• country code, 2 characters

• data-center code, 2 characters

• device name, 4 characters

You want to store this information in separate tags. You add an Extract Strings action to your workflow and format it as follows:

• Input field = source

• Regex capture groups = (\w{2})(\w{2})-(.*)

• Output fields:

• location.country

• location.datacenter

• tags.devicename

Event before

Event after

{
"severity": 5,
"source":"ussf-sw99",
"check":"cpu",
}


{
}