- 2 minutes to read

Formula - substring

substring(startIndex,length,Content) Formula function is used to extract/slice specific text from any given text.

Quick example

Let's get you started with the following example: For other, and more advanced examples please scroll down on this page to the Examples section.

Input Expression Result



Text Data substring expression Unique values


  • Slice/extract a given text from Content.
  • Set the start index (0-based).
  • Set the length (number of characters to include).
  • Can be applied to any valid Content that return a string; Like jsonpath, xpath functions, review the Formula user guide for a complete list of functions.

This plugin loads the entire message into RAM, so make sure to apply this function only on small messages.

How to use

To use the substring function, the Content parameter should return a text (otherwise it will fail and you will end up with no result). But first and foremost, we have to configure the Formula plugin:

  • Select Formula as the expression type plugin.
  • Write down the expression to use in the 'Expression' text area.
  • Input proper Content as a parameter to the function.


Use the base64decode function with any of the following parameters:

  • From Message Body: substring(startIndex,length,body)

  • From Message Context: substring(startIndex,length,context('MessageContextKey'))

  • Result from previous Formula operation substring(startIndex,length,SomeOtherNestedFormulaFunction(Content))


Below you will find different common examples of how to use the substring function.

Body as Content

"nodinite" is the body content, by using the provided expression, the result is nodi.

e.g. substring(0,4,body)

Simple Content parameter_substring

Message Body




Context as Content

"Amazing Function" is the Message Context value and the key is "id", by using the provided expression, the result is Amazing.

e.g. substring(0,7,context('id'))

Simple Content parameter_substring

Message Context Value

Amazing Function



Formula Function as Content

Body content is json array and the Content parameter is jsonpath function, by using the provided expression, the result is Co, ol.

e.g. substring(0,2,jsonpath('$..name',body))

nested Content parameter_substring

Message Body

	{ "name" :"column"},
	{"name" :"olive"}



Next Step

How to Add or manage Search Fields
How to Add or manage Log Views

Expression Type Plugins are used in Search Fields
What are Search Fields?
What are Search Field Expressions?
What are Message Types?
What are Log Views?