# Extracting from message

**URL:** <https://community.graylog.org/t/extracting-from-message/873>\
**Category:** Graylog Central (peer support)\
**Created:** [April 20, 2017, 4:04pm UTC](https://community.graylog.org/t/extracting-from-message/873 "2017-04-20T16:04:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nanna](https://avatars.discourse-cdn.com/v4/letter/n/e99b99/32.png) [@Nanna](https://community.graylog.org/u/Nanna)\
**Post date:** [April 20, 2017, 4:04pm UTC](https://community.graylog.org/t/extracting-from-message/873/1 "2017-04-20T16:04:35Z")

</div>

Hope someone can help me how to configure an extractor that in this example will extract (3)www(6)google(3)com(0) into a new name with [www.google.com](http://www.google.com) in a message field.

---

<div class="post-metadata">

**Author:** ![jtkarvo](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jtkarvo](https://community.graylog.org/u/jtkarvo)\
**Post date:** [April 23, 2017, 2:49pm UTC](https://community.graylog.org/t/extracting-from-message/873/2 "2017-04-23T14:49:43Z")

</div>

I think you could try something like:

- create new extractor
- extractor type: replace with regex
- regex: \([0-9]\*\)
- replace with: . (or \. if just a dot does not work)
- replace globally (all occurrences)
- save as newname

Then, if you want to get rid of the leading dot:

- create new extractor for the field newname
- extractor type: regex
- regex: ^\.(.\*?)$
- save as newname (the same field that is extracted from)

There is probably a more efficient way to do it, though.