> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/extractors.md).

# Extractors

Custom extractors allow you to extract specific information from source fields in collected logs and integrate it into other standard target fields or [custom fields](/docs/manual/english/platform-usage/siem/advanced-settings/custom-fields.md).

This is particularly useful when the required information cannot be detected and extracted automatically by the collectors you use and therefore cannot be shown in standard fields within log entries in the [data lake](/docs/manual/english/platform-usage/siem/data-lake.md).

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Extractors** to show a list of all custom extractors. If you have not created an extractor yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2F6SFlYKHVM76QxpT6wQSx%2Fenginsight-screenshot-siem-advanced%20settings-extractors.jpg?alt=media&amp;token=7190ce88-af71-4dee-832d-2fc89975c0e0" alt=""><figcaption></figcaption></figure>

The [extractor overview](#extractors-overview) provides information such as:

* the source field from which the extractor extracts information.
* the standard and/or custom target fields into which the information is extracted.
* whether an extractor is active or inactive.

You can also [add a new extractor](#add-extractor) and enable or disable an existing extractor.

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Filtering the List&#x20;

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

<details>

<summary>Available Filters</summary>

<table><thead><tr><th width="206.60546875">Parameter</th><th width="116.515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>Enabled</td><td>Boolean</td><td><p>Filter by all active or inactive extractors.<br></p><p>The following values are available:</p><ul><li><strong>True</strong>: The extractor is active.</li><li><strong>False</strong>: The extractor is inactive.</li></ul></td></tr><tr><td>User Defined Fields</td><td>String</td><td>Filter by all extractors in which a specific custom target field is defined, or exclude them from the results. All available custom fields are shown.</td></tr><tr><td>Capturing Groups</td><td>String</td><td>Filter by all extractors in which a specific standard target field is defined, or exclude them from the results. All available capturing groups are shown.</td></tr><tr><td>Source Field Name</td><td>String</td><td>Filter by all extractors in which a specific source field is defined, or exclude them from the results. All available source fields are shown.</td></tr></tbody></table>

</details>

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Further Actions for List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the respective item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list items is now shown next to the search field.

The <i class="fa-slider">:slider:</i> **Actions** menu also appears in the upper-right corner. Click it to expand the respective submenu. The following actions are available:

<table><thead><tr><th width="209.06640625">Action</th><th>Description</th></tr></thead><tbody><tr><td>Delete</td><td><p>Delete all selected objects.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Delete</strong> and confirm the prompt that appears by clicking <strong>Delete Irretrievably</strong>.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: Deleted items cannot be recovered.</p></div></td></tr><tr><td>Enable</td><td><i class="fa-eye">:eye:</i> This action is only available if all selected objects are inactive.<br><br>Enable all inactive objects.</td></tr><tr><td>Disable</td><td><i class="fa-eye">:eye:</i> This action is only available if all selected objects are active.<br><br>Disable all active objects.</td></tr></tbody></table>

***

## Extractors: Overview

The extractor overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2Fsih3SrSdJ7UkAF7sfq1z%2Fenginsight-screenshot-siem-advanced%20settings-extractors%20overview.jpg?alt=media&amp;token=d47d7dc4-e156-465f-a83d-c6211470c342" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="200.03125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the custom name of the extractor and an additional description, if provided.</p><p></p><p>The date and time of creation and last edit are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of an extractor to navigate to the respective <a href="#extractor-edit-view">edit view</a>. Here you can adjust configured settings and delete the extractor.</p></td></tr><tr><td>Source Field Name</td><td>Shows the name of the source field from which the extractor extracts information.</td></tr><tr><td>Capturing Groups</td><td>Shows the name or names of the standard target fields into which extracted information is integrated.</td></tr><tr><td>User Defined Fields</td><td>Shows the name or names of the <a href="/docs/manual/english/platform-usage/siem/advanced-settings/custom-fields.md">custom target fields</a>, if defined, into which extracted information is integrated.</td></tr><tr><td>Enabled</td><td>Shows whether the extractor is actively extracting information from raw logs.<br><br>An enabled extractor is indicated by a green <strong>check</strong> icon <i class="fa-circle-check" style="color:green;">:circle-check:</i>. Disabled extractors are indicated by a red <strong>circle</strong> icon <i class="fa-circle" style="color:red;">:circle:</i>.</td></tr></tbody></table>

***

## Adding an Extractor

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Add Extractor** in the upper-right corner to [create a new extractor](/docs/manual/english/platform-usage/siem/advanced-settings/extractors/add-extractor.md).

***

## Extractor: Edit View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the name of an extractor to navigate to the respective edit view. Here you can adjust [configured settings](/docs/manual/english/platform-usage/siem/advanced-settings/extractors/add-extractor.md#general-settings) and delete the extractor.

The following actions are available:

<table><thead><tr><th width="200.39453125">Option</th><th>Description</th></tr></thead><tbody><tr><td>Save Changes</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Save Changes</strong> after adjusting any settings.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Unsaved changes cannot be recovered.</p></div></td></tr><tr><td>Back</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Back</strong> to return to the list overview.</td></tr><tr><td>Remove</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Remove</strong>, then confirm the prompt that appears to delete the object that you are editing.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Deleted objects cannot be recovered.</p></div></td></tr></tbody></table>

***