Four extractor types: String Delimited, Regular Expression, Script (JavaScript), and JSON Array Collector. Use when Automatic State Management does not yet ship a rule for the pattern you need. Define the extractor once, expose the value as a bindable field, and ASM and the AI Assistant pick it up from there.
Automatic State Management handles the patterns we have seen often enough to ship a built-in rule for: OAuth2 Bearer tokens in JSON responses, JWT, .NET VIEWSTATE, cookies, CSRF nonces, the standard correlation shapes that show up in most web applications. The AI Assistant catches the long tail of variants that ASM does not have a built-in rule for, generating detection rules on the fly from runtime failures.
Custom extractors are the third layer. You reach for one when the pattern is specific to your application, when you want explicit control over the extraction logic, or when the value lives somewhere ASM and the AI Assistant do not look (a custom binary encoding, a value computed across multiple response fields, a JSON array where every element matters). Read about Automatic Configuration
Pull a value out of content that sits between known prefix and suffix strings. The fastest, most readable extractor when the value is bracketed by stable markers (an HTML attribute, a JSON field name, an environment-variable prefix). No regex needed; just declare the surrounding strings.
A full regex against the response content with capture groups. Reach for this when the surrounding context varies, when you need character-class matching, or when the value itself follows a pattern (UUID, hex digest, hash). Capture groups become the extracted value.
An extract(response, user_state) function with arbitrary JavaScript. response.getContent() returns the response body as a string; user_state exposes per-VU state from prior steps. Return the value, or null if no match. Use this when the extraction needs conditional logic ("if this header is present, extract X; otherwise extract Y"), multi-step lookups ("find this marker, then look 20 characters back"), or transformation ("decode this Base64 first, then pull the inner value").
For responses that return a JSON array where each element should bind to a separate virtual user. A common shape: a listing endpoint returns an array of IDs, and you want each VU to act on its own ID. The collector exposes the array elements as a list that downstream requests can iterate over.
Every extractor type runs live against the recorded response in the dialog. You see exactly what value comes back, or you see why nothing came back, without having to start a test run to find out.
Status feedback is direct: in the screenshot above, the script executed without errors but the recorded response did not contain a <title> tag, so the dialog reports "The script executed successfully, but no match was found in the content." That is what an empty result looks like, and it distinguishes "your code has a bug" from "your code is fine but the value is not in this response." Edit, re-run, see the result, repeat.
The point of exposing a value via a custom extractor is not just to bind it in one place. Once the extractor is in the test case and the extracted value is a named, bindable field, two things happen automatically:
You teach the system the pattern once. Custom rules can also be packaged as .properties configuration files and deployed across recordings without recompiling.
Try a custom extractor on your own response.
String Delimited, Regular Expression, JavaScript Script, and JSON Array Collector extractors ship in every edition of WPLoadTester 7. Request the beta to use them in a cloud-scale test, or download the free single-machine edition to evaluate locally.
Reference: the canonical ASM Extractors docs live at docs.webperformance.com.