---
title: "Create event extraction rule."
method: POST
path: "/v1/eventExtractionRules"
tags: ["eventAnalytics"]
---

# Create event extraction rule.

`POST /v1/eventExtractionRules`

Create event extraction rule.

## Request body

- EventExtractionRule
  - `name` string, required — Name of event extraction rule.
  - `description` string — Description of event extraction rule.
  - `query` string, required — Query string for the Event Extraction Rule. Logs matching this query are periodically ingested into the `sumologic_userdata_events` index (**Events**). Guidelines for creating the query: - Optimize the query to limit the number of returned log messages (intended for special logs only). - The query runs in `Manual` mode, explicitly parse and extract only the necessary fields for event correlation and visualization. - Use the `fields` operator to restrict the output to required fields.
  - `correlationExpression` object — Correlation Expression specifies how to determine related events for a log search query. The value of `eventFieldName` from Events is compared with the values of `queryFieldName` from the log search query output using the defined stringMatchingAlgorithm. Events that match according to this algorithm are considered correlated.
    - `queryFieldName` string, required — Name of the query field returned by a log search query.
    - `eventFieldName` string, required — Name of the field from event query output.
    - `stringMatchingAlgorithm` string, required — Type of string matching algorithm which tells how to match eventFieldName and queryFieldName.
  - `configuration` object, required — Configuration for the Event Extraction Rule. This object defines how event fields are mapped to their corresponding values. Each field specifies a `valueSource`, which provides the actual value, and an optional `mappingType`, indicating the value is hardcoded. The following fields are **required**: - `eventType`: Type of the event. Accepted values are `Deployment`, `Feature Flag Change`, `Configuration Change` or `Infrastructure Change`. - `eventPriority`: Indicates the priority of the event. Accepted values are `High`, `Medium`, or `Low`. - `eventSource`: Source system or component where the event originated (e.g., "Jenkins"). - `eventName`: Descriptive name of the event (e.g., "monitor-manager deployed."). The following fields are **optional**: - `eventDescription`: Additional context or details about the event. Custom fields can also be added as needed to capture domain-specific event data.

## Response `200`

The event extraction rule was created.

- EventExtractionRuleWithDetails — Event extraction rule object.
  - `name` string, required — Name of event extraction rule.
  - `description` string — Description of event extraction rule.
  - `query` string, required — Query string for the Event Extraction Rule. Logs matching this query are periodically ingested into the `sumologic_userdata_events` index (**Events**). Guidelines for creating the query: - Optimize the query to limit the number of returned log messages (intended for special logs only). - The query runs in `Manual` mode, explicitly parse and extract only the necessary fields for event correlation and visualization. - Use the `fields` operator to restrict the output to required fields.
  - `correlationExpression` object — Correlation Expression specifies how to determine related events for a log search query. The value of `eventFieldName` from Events is compared with the values of `queryFieldName` from the log search query output using the defined stringMatchingAlgorithm. Events that match according to this algorithm are considered correlated.
    - `queryFieldName` string, required — Name of the query field returned by a log search query.
    - `eventFieldName` string, required — Name of the field from event query output.
    - `stringMatchingAlgorithm` string, required — Type of string matching algorithm which tells how to match eventFieldName and queryFieldName.
  - `configuration` object, required — Configuration for the Event Extraction Rule. This object defines how event fields are mapped to their corresponding values. Each field specifies a `valueSource`, which provides the actual value, and an optional `mappingType`, indicating the value is hardcoded. The following fields are **required**: - `eventType`: Type of the event. Accepted values are `Deployment`, `Feature Flag Change`, `Configuration Change` or `Infrastructure Change`. - `eventPriority`: Indicates the priority of the event. Accepted values are `High`, `Medium`, or `Low`. - `eventSource`: Source system or component where the event originated (e.g., "Jenkins"). - `eventName`: Descriptive name of the event (e.g., "monitor-manager deployed."). The following fields are **optional**: - `eventDescription`: Additional context or details about the event. Custom fields can also be added as needed to capture domain-specific event data.
  - `id` string, required — Id of the event extraction rule.
  - `createdAt` string, date-time — Creation timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
  - `createdBy` string — Identifier of the user who created the resource.
  - `modifiedAt` string, date-time — Last modification timestamp in UTC.
  - `modifiedBy` string — Identifier of the user who last modified the resource.
  - `enabled` boolean — Flag indicating whether the event extraction rule is enabled or disabled.
  - `disableReason` string — Reason for disabling the event extraction rule, if applicable.

## Other responses

- `default` — Operation failed with an error.

---

[API](https://skmtc.net/sumologic/apis/sumo-logic-api.md) · [All operations](https://skmtc.net/sumologic/apis/sumo-logic-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sumologic/sumo-logic-api/revisions/18a824df1e78/schema)