---
title: "Create a new field extraction rule."
method: POST
path: "/v1/extractionRules"
tags: ["extractionRuleManagement"]
---

# Create a new field extraction rule.

`POST /v1/extractionRules`

Create a new field extraction rule.

## Request body

- ExtractionRuleDefinition
  - `name` string, required — Name of the field extraction rule. Use a name that makes it easy to identify the rule.
  - `scope` string, required — Scope of the field extraction rule. This could be a sourceCategory, sourceHost, or any other metadata that describes the data you want to extract from. Think of the Scope as the first portion of an ad hoc search, before the first pipe ( | ). You'll use the Scope to run a search against the rule.
  - `parseExpression` string, required — Describes the fields to be parsed.
  - `enabled` boolean — Is the field extraction rule enabled.

## Response `200`

The field extraction rule has been created.

- ExtractionRule
  - `name` string, required — Name of the field extraction rule. Use a name that makes it easy to identify the rule.
  - `scope` string, required — Scope of the field extraction rule. This could be a sourceCategory, sourceHost, or any other metadata that describes the data you want to extract from. Think of the Scope as the first portion of an ad hoc search, before the first pipe ( | ). You'll use the Scope to run a search against the rule.
  - `parseExpression` string, required — Describes the fields to be parsed.
  - `enabled` boolean — Is the field extraction rule enabled.
  - `createdAt` string, date-time, required — Creation timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
  - `createdBy` string, required — Identifier of the user who created the resource.
  - `modifiedAt` string, date-time, required — Last modification timestamp in UTC.
  - `modifiedBy` string, required — Identifier of the user who last modified the resource.
  - `id` string, required — Unique identifier for the field extraction rule.
  - `fieldNames` string[] — List of extracted fields from "parseExpression".

## Other responses

- `default` — Operation failed with an error.

---

[API](https://skmtc.net/sumologic/apis/sumo-logic-api.md) · [All operations](https://skmtc.net/sumologic/apis/sumo-logic-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sumologic/sumo-logic-api/revisions/e4e4c7554890/schema)