---
title: Event Transform
url: https://www.tines.com/docs/actions/types/event-transformation/
updated: 2026-02-20T15:24:10+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/llms.txt) › [Actions](https://www.tines.com/llm/docs/actions.md) › [Types](https://www.tines.com/llm/docs/actions/types.md)*

# Event Transform

*[View on tines.com](https://www.tines.com/docs/actions/types/event-transformation/)*

The Event Transform action has several modes of operation that either modify the contents of incoming events, or affect behavior of the workflow.

For example, you could:

- Extract all URLs from an email body (with **message only mode** and [`REGEX_EXTRACT`](https://www.tines.com/docs/formulas/functions/regex-extract)).
- Emit individual events for all IP addresses from a SIEM alert (with **explode mode**).
- Ignore processing information already seen recently (with **deduplicate mode**).

For tenants created after Jan 8th 2025 there is a limit of 10 minutes for Event Transform actions.

## Features

The Event Transform Action has several modes of operation:

- [Message only mode](https://hub.tines.com/docs/actions/types/event-transformation/message-only)
- [Explode mode](https://hub.tines.com/docs/actions/types/event-transformation/explode)
- [Extract mode](https://hub.tines.com/docs/actions/types/event-transformation/extract)
- [Deduplicate mode](https://hub.tines.com/docs/actions/types/event-transformation/deduplicate)
- [Delay mode](https://hub.tines.com/docs/actions/types/event-transformation/delay)
- [Implode mode](https://hub.tines.com/docs/actions/types/event-transformation/implode)
- [Throttle mode](https://hub.tines.com/docs/actions/types/event-transformation/throttle)
- [Automatic mode](https://www.tines.com/docs/automatic/)

## Common options

- `rules`: (Optional) Specify the rules to determine if this action executes.
- `must_match`: (Optional) Specify the number of rules that must match for the action to execute.
- `include_metadata`: (Optional) Adds a `meta` key to the event with details about the action run. This applies to automatic, deduplicate, explode, extract and message_only modes. Learn more about this option in Action Metadata [docs](https://tines.com/docs/actions/configuration/#action-metadata).

### Rules

Rules allow you to specify criteria that must be met in order for an event to be emitted. The Event Transform action can parse the event data from upstream action to meet these criteria. An event is created only when a rule is matched, and the matching rule is included in the `meta` object of the event if `include_metadata` is turned on.  If no rule is matched, a log line is emitted.

In the following example, we are checking if a status from an upstream HTTP Request action matches the value.

```json
{
  "path": "4d4217f7e94467ee3dec675189566f9a",
  "secret": "a409cd0d15a079ee69873aaa5b2e3d04",
  "verbs": "get,post",
  "must_match": 1,
  "rules": [
    {
      "type": "field==value",
      "value": "200",
      "path": "<<http_request_action.body>>"
    },
  ]
}
```