> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Extract keys/values

> Learn about the extract keys/values processing rule in Palo Alto Networks Telemetry Pipeline.

export const entity_0 = "extract keys/values processing rule"

<Info>
  This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone
  product separate from Palo Alto Networks Cortex XCOR.
</Info>

The extract keys/values [processing rule](/ingest/pipeline/processing-rules) uses a
regular expression to search for key-value pairs inside a string, then creates a
structured object to store those key-value pairs. Additionally, the resulting
output always includes a string of the original unstructured data.

The resulting output includes both the original JSON data
and a string of comma-separated values assigned to a key you specify.

## Configuration parameters

Use the parameters in this section to configure the {entity_0}. The
Palo Alto Networks Telemetry Pipeline web interface uses the items in the **Name** column to
describe these parameters. [Pipeline configuration files](/ingest/pipeline/v2/configure/config-files)
use the items in the **Key** column as YAML keys.

| Name | Key | Description | Default |
| - | - | - | - |
| **Source key** | `src` | Required. The key whose value contains key-value pairs to extract. | *none* |
| **Destination key** | `dst` | Required. The key of the object to store your structured key-value pairs. If you specify the name of an existing key, the original value of the key is overwritten. | *none* |
| **Regex** | `regex` | Required. The regular expression for extracting key-value pairs from the value of **Source key**. This expression must have two capture groups: the result of the first capture group becomes the name of a key, and the result of the second capture group becomes that key's value. | *none* |
| **Regex engine** | `regexEngine` | Required. The [engine](/ingest/pipeline/processing-rules#regex-engines) to parse your regular expression. Accepted values: `GNU`, `Oniguruma`, `PCRE2`, `POSIX`, `TRE`. | `PCRE2` |
| **Comment** | `comment` | A custom note or description of the rule's function. This text is displayed next to the rule's name in the **Actions** list in the processing rules interface. | *none* |

## Example

Using the extract keys/values rule lets you extract embedded data from a string and turn
it into parsable key-value pairs. You can then use these key-value pairs in other
processing rules or for general storage and analysis.

For example, given the following sample website log data:

```json theme={null}
{"log": "user_id:3,page_id:30,action:purchase"}
{"log": "user_id:4,page_id:10,action:purchase"}
{"log": "user_id:1,page_id:50,action:click"}
{"log": "user_id:5,page_id:40,action:purchase"}
{"log": "user_id:1,page_id:30,action:purchase"}
{"log": "user_id:2,page_id:40,action:click"}
{"log": "user_id:3,page_id:30,action:click"}
{"log": "user_id:1,page_id:20,action:view"}
{"log": "user_id:2,page_id:50,action:purchase"}
{"log": "user_id:2,page_id:10,action:view"}
{"log": "user_id:1,page_id:50,action:view"}
```

A processing rule with the **Source key** value `log`, the **Destination key**
value `extracted`, the **Regex** value `(\w+):(\w+)`, and the **Regex
engine** value `PCRE2` returns the following result:

```json theme={null}
{"extracted":{"action":"purchase","user_id":"3","page_id":"30"},"log":"user_id:3,page_id:30,action:purchase"}
{"extracted":{"action":"purchase","user_id":"4","page_id":"10"},"log":"user_id:4,page_id:10,action:purchase"}
{"extracted":{"action":"click","user_id":"1","page_id":"50"},"log":"user_id:1,page_id:50,action:click"}
{"extracted":{"action":"purchase","user_id":"5","page_id":"40"},"log":"user_id:5,page_id:40,action:purchase"}
{"extracted":{"action":"purchase","user_id":"1","page_id":"30"},"log":"user_id:1,page_id:30,action:purchase"}
{"extracted":{"action":"click","user_id":"2","page_id":"40"},"log":"user_id:2,page_id:40,action:click"}
{"extracted":{"action":"click","user_id":"3","page_id":"30"},"log":"user_id:3,page_id:30,action:click"}
{"extracted":{"action":"view","user_id":"1","page_id":"20"},"log":"user_id:1,page_id:20,action:view"}
{"extracted":{"action":"purchase","user_id":"2","page_id":"50"},"log":"user_id:2,page_id:50,action:purchase"}
{"extracted":{"action":"view","user_id":"2","page_id":"10"},"log":"user_id:2,page_id:10,action:view"}
{"extracted":{"action":"view","user_id":"1","page_id":"50"},"log":"user_id:1,page_id:50,action:view"}
```

This rule extracted key-value pairs from the string stored in the `log` key and
stored those key-value pairs in a new structured object named `extracted`.

## Related rules

For a processing rule that performs a similar operation on escaped JSON strings,
see [decode JSON](/ingest/pipeline/processing-rules/decode-json). For a processing
rule that performs a similar operation on data not already formatted as key-value
pairs, see [parse](/ingest/pipeline/processing-rules/parse).


## Related topics

- [Parse](/ingest/pipeline/processing-rules/parse.md)
- [Decode JSON](/ingest/pipeline/processing-rules/decode-json.md)
- [Processing rules](/ingest/pipeline/processing-rules.md)
- [CreateLogIngestConfig](/tooling/api-info/definition/operations/CreateLogIngestConfig.md)
- [ReadLogIngestConfig](/tooling/api-info/definition/operations/ReadLogIngestConfig.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.