Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Flanguage-reference%2Fcommands-reference%2Fextract.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Flanguage-reference%2Fcommands-reference%2Fextract.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# `extract`

## Description

The `extract` function allows you to transform raw strings into structured data by parsing out embedded values and storing them as objects. It supports various extraction strategies to convert unstructured fields into clean, queryable formats.

## Syntax

```
(e|extract) <expression> into <keypath> using <extraction-type>(<extraction-params>) [datatypes keypath:datatype,keypath:datatype,...]
```

## Extractor functions[​](#extractor-functions "Direct link to Extractor functions")

Extractor functions define how raw strings are parsed and transformed into structured objects when using the `extract` keyword. Each function handles a specific format, such as regular expressions, key-value pairs, delimited lists, or escaped JSON. You specify the extractor using the `using` clause, which determines how the string will be interpreted. With the right extractor, you can convert unstructured data into clean, queryable objects for filtering, analysis, and visualization.

### 1. `regexp`[​](#1-regexp "Direct link to 1-regexp")

Parses data using **named capture groups** in a regular expression.

#### Input[​](#input "Direct link to Input")

```
{

  "message": "user Chris has logged in"

}
```

#### Query[​](#query "Direct link to Query")

```
extract message into user_data using regexp(e=/user (?<user>.*) has logged in/)
```

#### Output[​](#output "Direct link to Output")

```
{

  "message": "user Chris has logged in",

  "user_data": {

    "user": "Chris"

  }

}
```

### 2. `multi_regexp`[​](#2-multi_regexp "Direct link to 2-multi_regexp")

Extracts **all matches** of a pattern into an **array**.

#### Input[​](#input-1 "Direct link to Input")

```
{

  "log": "user 1 did 2 things on 3 pages"

}
```

#### Query[​](#query-1 "Direct link to Query")

```
extract log into numbers using multi_regexp(e=/\d+/)
```

#### Output[​](#output-1 "Direct link to Output")

```
{

  "log": "user 1 did 2 things on 3 pages",

  "numbers": ["1", "2", "3"]

}
```

### 3. `kv`[​](#3-kv "Direct link to 3-kv")

Parses a string of key-value pairs into an object.

#### Input[​](#input-2 "Direct link to Input")

```
{

  "query_string": "a=b&b=c&c=d"

}
```

#### Query[​](#query-2 "Direct link to Query")

```
extract query_string into query_params using kv(pair_delimiter='&', key_delimiter='=')
```

#### Output[​](#output-2 "Direct link to Output")

```
{

  "query_string": "a=b&b=c&c=d",

  "query_params": {

    "a": "b",

    "b": "c",

    "c": "d"

  }

}
```

### 4. `jsonobject`[​](#4-jsonobject "Direct link to 4-jsonobject")

Unescapes and parses a stringified JSON object.

#### Input[​](#input-3 "Direct link to Input")

```
{

  "nested_json": "{\"key\": \"value\"}"

}
```

#### Query[​](#query-3 "Direct link to Query")

```
extract nested_json into parsed_json using jsonobject()
```

#### Output[​](#output-3 "Direct link to Output")

```
{

  "nested_json": "{\"key\": \"value\"}",

  "parsed_json": {

    "key": "value"

  }

}
```

### 5. `split`[​](#5-split "Direct link to 5-split")

Splits a string by a delimiter into an array of primitive values.

#### Input[​](#input-4 "Direct link to Input")

```
{

  "csv_codes": "10,20,30"

}
```

#### Query[​](#query-4 "Direct link to Query")

```
extract csv_codes into codes using split(delimiter=',', element_datatype=number)
```

#### Output[​](#output-4 "Direct link to Output")

```
{

  "csv_codes": "10,20,30",

  "codes": [10, 20, 30]

}
```

## Using `datatypes` to annotate extracted fields[​](#using-datatypes-to-annotate-extracted-fields "Direct link to using-datatypes-to-annotate-extracted-fields")

You can provide explicit type annotations to specific fields using the `datatypes` clause. This ensures values are stored with the correct type, enabling numerical comparisons, aggregations, and more.

#### Input[​](#input-5 "Direct link to Input")

```
{

  "msg": "query_type=fetch query_id=100 query_results_duration_ms=232"

}
```

#### Query[​](#query-5 "Direct link to Query")

```
extract msg into query_data using kv() datatypes query_results_duration_ms:number
```

#### Output[​](#output-5 "Direct link to Output")

```
{

  "msg": "query_type=fetch query_id=100 query_results_duration_ms=232",

  "query_data": {

    "query_type": "fetch",

    "query_id": "100",

    "query_results_duration_ms": 232

  }

}
```

> `query_results_duration_ms` is now a number, while `query_id` remains a string.

Note

You only need to specify the extracted field name in `datatypes`, not the full keypath.

## Summary[​](#summary "Direct link to Summary")

The `extract` keyword, combined with extractor functions, provides a flexible and powerful way to transform messy strings into usable structured data. Whether you're parsing JSON blobs, splitting CSV-like fields, or decoding regex patterns, the extractor system helps you build clean logs and metrics pipelines in a declarative, readable way.