Extracting data from traffic logs using regular expressions. A traffic log is received from a network device. A characterization of an extraction of data from the traffic log is determined. The traffic log is parsed by applying a first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data. Data is extracted from the traffic log by applying a second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.