---
title: Extract mode
url: https://www.tines.com/docs/actions/types/event-transformation/extract/
updated: 2026-02-20T15:57:31+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/llms.txt) › [Actions](https://www.tines.com/llm/docs/actions.md) › [Types](https://www.tines.com/llm/docs/actions/types.md) › [Event Transform](https://www.tines.com/llm/docs/actions/types/event-transformation.md)*

# Extract mode

*[View on tines.com](https://www.tines.com/docs/actions/types/event-transformation/extract/)*

Use regular expressions to extract text from fields in incoming events.

## Features

- Specify one or more [Ruby compatible](http://rubular.com/) regular expressions to match and extract text from incoming events.
- Any matched text will be included in an array in a new event. If there are no matches, no event will be emitted by default.
- Specify the name of the key for each array of matched text.

## Configuration Options

- `mode`: 'Extract'
- `matchers`: When using 'Extract' mode, define an array of regular expression configuration blocks to match text in incoming events:
- `path`: Specify the wrapped JSON path for the field containing text to extract.
- `regexp`: Specify the regular expression to be used to extract text.
- `to`: Specify the name of the field to contain the array of matches.
- `emit_no_match`: (Optional) By setting `emit_no_match` to `true` an event will also be emitted if the regular expression does not match.

## Emitted Events

```json
{
  "email_addresses": ["alice@example.com"],
  "ips": ["10.1.1.12"],
  "urls": ["http://example.com", "https://tines.com"]
}
```

## Example Configuration Options

Given the incoming event below, extract all email addresses and store them in a field called 'email_addresses' in a new Event.

```json
{
  "text": "You received to email to alice@example.com sent from bob@example.com"
}
```

```json
{
  "mode": "extract",
  "matchers": [
    {
      "path": "<<text>>",
      "regexp": "\\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,4}\\b",
      "to": "email_addresses"
    }
  ]
}
```

Given the incoming event below, extract all email addresses from 'text' store them in a field called 'email_addresses'; extract all URLs from 'referrers' and store them in a field called 'urls'; and extract all IP addresses from 'servers' and store them in a field called 'ips'.

```json
{
  "text": "You received to email to alice@example.com sent from bob@example.com",
  "metadata": {
    "servers": "10.1.1.1, 10.2.3.4, 10.15.6.8",
    "referrers": "https://tines.com and https://www.example.com"
  }
}
```

```json
{
  "mode": "extract",
  "matchers": [
    {
      "path": "<<text>>",
      "regexp": "\\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,4}\\b",
      "to": "email_addresses"
    },
    {
      "path": "<<metadata.referrers>>",
      "regexp": "https?:\\/\\/[\\S]+",
      "to": "urls"
    },
    {
      "path": "<<metadata.servers>>",
      "regexp": "\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b",
      "to": "ip_addresses"
    }
  ],
  "message": "Email addresses taken from text, Urls from referrers and IPs from servers."
}
```