diff --git a/plugin/README.md b/plugin/README.md
index 2fdc68dcd..690794398 100755
--- a/plugin/README.md
+++ b/plugin/README.md
@@ -788,7 +788,7 @@ pipelines:
     - type: transform
       source: |
         # parse lines like "INFO 2025-05-25 11:11:11,222 [shard 1] compaction - done"
-        m = capture(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
+        m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
         if m != null {
           .level = m.level
           .time = m.time
diff --git a/plugin/action/README.md b/plugin/action/README.md
index 1c91ebb75..d9a4d508a 100755
--- a/plugin/action/README.md
+++ b/plugin/action/README.md
@@ -609,7 +609,7 @@ pipelines:
     - type: transform
       source: |
         # parse lines like "INFO 2025-05-25 11:11:11,222 [shard 1] compaction - done"
-        m = capture(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
+        m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
         if m != null {
           .level = m.level
           .time = m.time
diff --git a/plugin/action/transform/README.idoc.md b/plugin/action/transform/README.idoc.md
index eaa1844e8..16ccbe8f8 100644
--- a/plugin/action/transform/README.idoc.md
+++ b/plugin/action/transform/README.idoc.md
@@ -61,9 +61,9 @@ In conditions `null` and `false` are falsy; every other value is truthy.
 Variables hold intermediate values and live for one event:
 
 ```
-name = .user.name             # read a field into a variable
-parts = capture(.log, r'...') # keep a function result
-.out = name                   # write it back to the event
+name = .user.name                 # read a field into a variable
+parts = parse_regex(.log, r'...')  # keep a function result
+.out = name                       # write it back to the event
 ```
 
 Fields of object values are accessed with a dot or an index; both forms are
@@ -95,7 +95,7 @@ In order of increasing precedence:
 | `f()` `a[i]` `a.b` | call, index, member access |
 
 `+` concatenates only strings with strings — convert other values first:
-`"code " + string(.code)`.
+`"code " + to_string(.code)`.
 
 ### Control flow
 
@@ -129,22 +129,32 @@ are required; named arguments are optional and fall back to their defaults:
   .level = upcase(.level)    # "info" -> "INFO"
   ```
 
-+ `string(value)` — converts any value to its string representation; `null`
++ `to_string(value)` — converts any value to its string representation; `null`
   becomes an empty string. Use it to build strings from non-string fields:
   ```
-  .msg = "code is " + string(.code)
+  .msg = "code is " + to_string(.code)
   ```
 
-+ `capture(value, pattern)` — matches the string against a regular expression
-  and returns an object of its named groups `(?P<name>...)`, or `null` when the
-  value does not match (unnamed groups are ignored):
++ `parse_regex(value, pattern, numeric_groups: false)` — matches the string
+  against a regular expression and returns an object of its named groups
+  `(?P<name>...)`, or `null` when the value does not match (unnamed groups are
+  ignored):
   ```
-  m = capture(.log, r'^(?P<level>\S+)\s+(?P<message>.+)$')
+  m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<message>.+)$')
   if m != null {
     .level = m.level
     .message = m.message
   }
   ```
+  With `numeric_groups: true` every group is additionally keyed by its index as a
+  string — `"0"` is the whole match — which is how a pattern without named groups
+  is read:
+  ```
+  m = parse_regex(.message, r'(\w+):.*', numeric_groups: true)
+  if m != null {
+    .level = m["1"]
+  }
+  ```
 
 + `after(value, separator)` — returns everything after the first occurrence of
   `separator`; the value is returned unchanged when the separator is not found.
@@ -164,6 +174,47 @@ are required; named arguments are optional and fall back to their defaults:
   .shard = between(.log, "[", "]")
   ```
 
++ `parse_regex_all(value, pattern, group: 0, limit: -1)` — returns every match of
+  `pattern` as an array, or an empty array when nothing matches. `group` selects
+  a capture group (`0` is the whole match) and a negative `limit` collects all
+  occurrences:
+  ```
+  .ids = parse_regex_all(.log, r'id=(\w+)', group: 1)
+  ```
+
++ `join(value, separator)` — joins an array of strings into one string. Only
+  strings are joined; convert other values with `to_string()` first:
+  ```
+  .extracted = join(parse_regex_all(.message, r're\d+', limit: 2), ",")   # "re1,re2"
+  ```
+
++ `trim(value, cutset)`, `trim_left(value, cutset)`,
+  `trim_right(value, cutset)` — strip characters from both ends, the start or
+  the end. `cutset` is a *set of characters*, not a substring: `trim_right(v, "ms")`
+  removes every trailing `m` and `s`.
+  ```
+  .message = trim_right(.message, "\n")
+  ```
+
++ `trim_to(value, cutset)`, `trim_to_left(value, cutset)`,
+  `trim_to_right(value, cutset)` — cut the string back to a delimiter, keeping the
+  delimiter itself; the value is returned unchanged when it is not found. Here
+  `cutset` is a *substring*: the left side trims to its first occurrence, the
+  right side to its last one, so the outermost pair is kept:
+  ```
+  # 'some data {"took":"200ms"} some data' -> '{"took":"200ms"}'
+  .message = trim_to_right(trim_to_left(.message, "{"), "}")
+  ```
+
++ `slice(value, start, end: null)` — returns the part of the string between two
+  positions, counted in characters. Both positions may be negative to count from
+  the end, and positions outside the string are clamped rather than raising an
+  error. `end` defaults to the end of the string:
+  ```
+  .head = slice(.message, 0, end: 10)   # first 10 characters
+  .tail = slice(.message, -5)           # last 5 characters
+  ```
+
 + `lookup(value, table, default: <unchanged>)` — translates a value through a
   table of replacements. It turns enumeration codes into readable names without
   a chain of `if`s:
diff --git a/plugin/action/transform/README.md b/plugin/action/transform/README.md
index 1084cf55f..83747c69b 100755
--- a/plugin/action/transform/README.md
+++ b/plugin/action/transform/README.md
@@ -12,7 +12,7 @@ pipelines:
     - type: transform
       source: |
         # parse lines like "INFO 2025-05-25 11:11:11,222 [shard 1] compaction - done"
-        m = capture(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
+        m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
         if m != null {
           .level = m.level
           .time = m.time
@@ -106,9 +106,9 @@ In conditions `null` and `false` are falsy; every other value is truthy.
 Variables hold intermediate values and live for one event:
 
 ```
-name = .user.name             # read a field into a variable
-parts = capture(.log, r'...') # keep a function result
-.out = name                   # write it back to the event
+name = .user.name                 # read a field into a variable
+parts = parse_regex(.log, r'...')  # keep a function result
+.out = name                       # write it back to the event
 ```
 
 Fields of object values are accessed with a dot or an index; both forms are
@@ -140,7 +140,7 @@ In order of increasing precedence:
 | `f()` `a[i]` `a.b` | call, index, member access |
 
 `+` concatenates only strings with strings — convert other values first:
-`"code " + string(.code)`.
+`"code " + to_string(.code)`.
 
 ### Control flow
 
@@ -174,22 +174,32 @@ are required; named arguments are optional and fall back to their defaults:
   .level = upcase(.level)    # "info" -> "INFO"
   ```
 
-+ `string(value)` — converts any value to its string representation; `null`
++ `to_string(value)` — converts any value to its string representation; `null`
   becomes an empty string. Use it to build strings from non-string fields:
   ```
-  .msg = "code is " + string(.code)
+  .msg = "code is " + to_string(.code)
   ```
 
-+ `capture(value, pattern)` — matches the string against a regular expression
-  and returns an object of its named groups `(?P<name>...)`, or `null` when the
-  value does not match (unnamed groups are ignored):
++ `parse_regex(value, pattern, numeric_groups: false)` — matches the string
+  against a regular expression and returns an object of its named groups
+  `(?P<name>...)`, or `null` when the value does not match (unnamed groups are
+  ignored):
   ```
-  m = capture(.log, r'^(?P<level>\S+)\s+(?P<message>.+)$')
+  m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<message>.+)$')
   if m != null {
     .level = m.level
     .message = m.message
   }
   ```
+  With `numeric_groups: true` every group is additionally keyed by its index as a
+  string — `"0"` is the whole match — which is how a pattern without named groups
+  is read:
+  ```
+  m = parse_regex(.message, r'(\w+):.*', numeric_groups: true)
+  if m != null {
+    .level = m["1"]
+  }
+  ```
 
 + `after(value, separator)` — returns everything after the first occurrence of
   `separator`; the value is returned unchanged when the separator is not found.
@@ -209,6 +219,47 @@ are required; named arguments are optional and fall back to their defaults:
   .shard = between(.log, "[", "]")
   ```
 
++ `parse_regex_all(value, pattern, group: 0, limit: -1)` — returns every match of
+  `pattern` as an array, or an empty array when nothing matches. `group` selects
+  a capture group (`0` is the whole match) and a negative `limit` collects all
+  occurrences:
+  ```
+  .ids = parse_regex_all(.log, r'id=(\w+)', group: 1)
+  ```
+
++ `join(value, separator)` — joins an array of strings into one string. Only
+  strings are joined; convert other values with `to_string()` first:
+  ```
+  .extracted = join(parse_regex_all(.message, r're\d+', limit: 2), ",")   # "re1,re2"
+  ```
+
++ `trim(value, cutset)`, `trim_left(value, cutset)`,
+  `trim_right(value, cutset)` — strip characters from both ends, the start or
+  the end. `cutset` is a *set of characters*, not a substring: `trim_right(v, "ms")`
+  removes every trailing `m` and `s`.
+  ```
+  .message = trim_right(.message, "\n")
+  ```
+
++ `trim_to(value, cutset)`, `trim_to_left(value, cutset)`,
+  `trim_to_right(value, cutset)` — cut the string back to a delimiter, keeping the
+  delimiter itself; the value is returned unchanged when it is not found. Here
+  `cutset` is a *substring*: the left side trims to its first occurrence, the
+  right side to its last one, so the outermost pair is kept:
+  ```
+  # 'some data {"took":"200ms"} some data' -> '{"took":"200ms"}'
+  .message = trim_to_right(trim_to_left(.message, "{"), "}")
+  ```
+
++ `slice(value, start, end: null)` — returns the part of the string between two
+  positions, counted in characters. Both positions may be negative to count from
+  the end, and positions outside the string are clamped rather than raising an
+  error. `end` defaults to the end of the string:
+  ```
+  .head = slice(.message, 0, end: 10)   # first 10 characters
+  .tail = slice(.message, -5)           # last 5 characters
+  ```
+
 + `lookup(value, table, default: <unchanged>)` — translates a value through a
   table of replacements. It turns enumeration codes into readable names without
   a chain of `if`s:
diff --git a/plugin/action/transform/compiler/fold_test.go b/plugin/action/transform/compiler/fold_test.go
index b5d38c7a6..7c32fb886 100644
--- a/plugin/action/transform/compiler/fold_test.go
+++ b/plugin/action/transform/compiler/fold_test.go
@@ -130,11 +130,11 @@ Assign
 		},
 		{
 			name: "regex literal folds after it is compiled",
-			src:  `m = capture(.log, r'(?P<a>\d+)')`,
+			src:  `m = parse_regex(.log, r'(?P<a>\d+)')`,
 			want: `
 Assign
   Ident(m)
-  Call(capture)
+  Call(parse_regex)
     Path(.log)
     Const(r'(?P<a>\d+)')`,
 		},
diff --git a/plugin/action/transform/core/ast.go b/plugin/action/transform/core/ast.go
index f326893a7..738d2e577 100644
--- a/plugin/action/transform/core/ast.go
+++ b/plugin/action/transform/core/ast.go
@@ -176,7 +176,7 @@ type ForExpr struct {
 // dump of a folded constant is stable across runs.
 //
 // Value.String() deliberately does not sort: it sits on the runtime path of
-// string(value), and debug output is the only place that needs a stable order.
+// to_string(value), and debug output is the only place that needs a stable order
 func dumpValue(v Value) string {
 	switch t := v.(type) {
 	case StringValue:
diff --git a/plugin/action/transform/core/value.go b/plugin/action/transform/core/value.go
index c7cc1422c..d7075e05b 100644
--- a/plugin/action/transform/core/value.go
+++ b/plugin/action/transform/core/value.go
@@ -208,7 +208,7 @@ func (v ArrayValue) String() string {
 }
 
 // Key order follows Go map iteration and is therefore not stable. This is on
-// the runtime path of string(value), so it does not pay for a sort; debug
+// the runtime path of to_string(value), so it does not pay for a sort; debug
 // output that needs a stable rendering uses dumpValue instead.
 func (v ObjectValue) String() string {
 	parts := make([]string, 0, len(v.V))
diff --git a/plugin/action/transform/core/value_test.go b/plugin/action/transform/core/value_test.go
index 044c4acce..86bcd66b1 100644
--- a/plugin/action/transform/core/value_test.go
+++ b/plugin/action/transform/core/value_test.go
@@ -10,7 +10,7 @@ import (
 
 // Debug output must not depend on Go map iteration order, so that the dump of a
 // folded constant is reproducible. Value.String() is deliberately unsorted -
-// it sits on the runtime path of string(value) - so the sort lives in dumpValue.
+// it sits on the runtime path of to_string(value) - so the sort lives in dumpValue
 func TestDumpConstIsStable(t *testing.T) {
 	t.Parallel()
 
diff --git a/plugin/action/transform/doc_examples_test.go b/plugin/action/transform/doc_examples_test.go
index f88e5f58f..e0f04ac72 100644
--- a/plugin/action/transform/doc_examples_test.go
+++ b/plugin/action/transform/doc_examples_test.go
@@ -1,6 +1,9 @@
 package transform
 
 import (
+	"fmt"
+	"os"
+	"strings"
 	"testing"
 
 	"github.com/ozontech/file.d/plugin/action/transform/compiler"
@@ -8,11 +11,39 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// validate examples from both the documentation source and the generated README
+func TestReadmeExamplesCompile(t *testing.T) {
+	for _, path := range []string{"README.idoc.md", "README.md"} {
+		t.Run(path, func(t *testing.T) {
+			data, err := os.ReadFile(path)
+			require.NoError(t, err)
+
+			blocks := strings.Split(string(data), "```")
+			count := 0
+			for i := 1; i < len(blocks); i += 2 {
+				// unlabelled code blocks contain transform programs
+				if !strings.HasPrefix(blocks[i], "\n") {
+					continue
+				}
+				count++
+				t.Run(fmt.Sprintf("example_%d", count), func(t *testing.T) {
+					cmp, err := compiler.NewCompiler(blocks[i])
+					require.NoError(t, err)
+					exprs, err := cmp.Compile()
+					require.NoError(t, err)
+					require.NoError(t, compiler.ValidateCalls(exprs, stdlib.GetRegistry()))
+				})
+			}
+			require.Positive(t, count, "documentation must contain program examples")
+		})
+	}
+}
+
 // compile and validate every program snippet shown in the plugin documentation.
 func TestDocExamplesCompile(t *testing.T) {
 	snippets := []string{
 		// introduction example
-		`m = capture(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
+		`m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
 		if m != null {
 		  .level = m.level
 		  .time = m.time
@@ -27,11 +58,11 @@ func TestDocExamplesCompile(t *testing.T) {
 		`.a.b.c = 1`,
 		`del .user.password`,
 		// variables
-		"name = .user.name\nparts = capture(.log, r'...')\n.out = name",
+		"name = .user.name\nparts = parse_regex(.log, r'...')\n.out = name",
 		"x = parts.level\narr = [1]\narr[0] = 1\nobj = {}\nobj.key = \"value\"",
 		`a = b = 1`,
 		// operators
-		`.msg = "code is " + string(.code)`,
+		`.msg = "code is " + to_string(.code)`,
 		// control flow
 		`if .status >= 500 {
 		  .severity = "crit"
@@ -50,7 +81,7 @@ func TestDocExamplesCompile(t *testing.T) {
 		}`,
 		// functions
 		`.level = upcase(.level)`,
-		`m = capture(.log, r'^(?P<level>\S+)\s+(?P<message>.+)$')
+		`m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<message>.+)$')
 		if m != null {
 		  .level = m.level
 		  .message = m.message
@@ -58,6 +89,16 @@ func TestDocExamplesCompile(t *testing.T) {
 		`.message = after(.log, " - ")`,
 		`.level = before(.log, " ")`,
 		`.shard = between(.log, "[", "]")`,
+		`m = parse_regex(.message, r'(\w+):.*', numeric_groups: true)
+		if m != null {
+		  .level = m["1"]
+		}`,
+		`.ids = parse_regex_all(.log, r'id=(\w+)', group: 1)`,
+		`.extracted = join(parse_regex_all(.message, r're\d+', limit: 2), ",")`,
+		`.message = trim_right(.message, "\n")`,
+		`.message = trim_to_right(trim_to_left(.message, "{"), "}")`,
+		`.head = slice(.message, 0, end: 10)
+		.tail = slice(.message, -5)`,
 		`api_key = {"0": "produce", "1": "fetch", "2": "offsets"}
 		.kafka_request_api_key = lookup(.kafka_request_api_key, api_key)`,
 		`.severity = lookup(.status, {"500": "crit", "400": "warn"}, default: "ok")`,
diff --git a/plugin/action/transform/runtime/root_target.go b/plugin/action/transform/runtime/root_target.go
index 0a4ec046a..445db1ae3 100644
--- a/plugin/action/transform/runtime/root_target.go
+++ b/plugin/action/transform/runtime/root_target.go
@@ -1,6 +1,7 @@
 package runtime
 
 import (
+	"encoding/json"
 	"fmt"
 	"strconv"
 	"strings"
@@ -59,32 +60,94 @@ func (t *RootTarget) Set(path core.Path, value core.Value) error {
 		return fmt.Errorf("set %s: %w", formatSegments(path.Segments), err)
 	}
 
-	encoded, err := valueToJSON(value)
-	if err != nil {
-		return fmt.Errorf("set %s: %w", formatSegments(path.Segments), err)
+	// a composite has to be serialized before the tree is touched below:
+	// calling AddFieldNoAlloc splices into the parent's node chain, and encoding a source
+	// node that lives under that same parent must happen while the chain is still
+	// intact
+	scalar := isScalarValue(value)
+	var encoded string
+	if !scalar {
+		encoded, err = valueToJSON(value)
+		if err != nil {
+			return fmt.Errorf("set %s: %w", formatSegments(path.Segments), err)
+		}
 	}
 
 	leaf := path.Segments[len(path.Segments)-1]
+	var node *insaneJSON.Node
 	if leaf.IsIndex() {
 		arr := parent.AsArray()
 		idx := resolveIndex(leaf.Idx, len(arr))
 		if idx < 0 || idx >= len(arr) {
 			return fmt.Errorf("set: index %d out of bounds", leaf.Idx)
 		}
-		node := arr[idx]
-		node.MutateToJSON(t.Root, encoded)
+		node = arr[idx]
 	} else {
-		existing := parent.Dig(leaf.Field)
-		if existing == nil {
-			parent.AddFieldNoAlloc(t.Root, leaf.Field).MutateToJSON(t.Root, encoded)
-		} else {
-			existing.MutateToJSON(t.Root, encoded)
+		node = parent.Dig(leaf.Field)
+		if node == nil {
+			node = parent.AddFieldNoAlloc(t.Root, leaf.Field)
 		}
 	}
 
+	if scalar {
+		setScalar(node, value)
+	} else {
+		node.MutateToJSON(t.Root, encoded)
+	}
+
 	return nil
 }
 
+// isScalarValue reports whether value can be written with one of insane-json's
+// typed mutators, which only set a node's bits and data
+//
+// everything else goes through valueToJSON plus MutateToJSON, which serializes
+// the value and parses it back; that round trip is what makes an assignment cost
+// a full encode and re-parse of the subtree, and it is also what draws nodes
+// from the root's decoder pool on every assignment
+//
+// a number read out of the event is deliberately not treated as scalar: the node
+// keeps the literal exactly as it was written ("1.50", "1e3"), and rewriting it
+// through MutateToFloat would change what the event carries downstream
+// numbers produced by the language itself carry no literal, so they stay on the fast path
+func isScalarValue(v core.Value) bool {
+	switch val := v.(type) {
+	case core.NullValue, core.BoolValue, core.IntegerValue, core.FloatValue, core.StringValue:
+		return true
+	case core.JSONNodeValue:
+		n := val.N
+		return n == nil || n.IsNull() || n.IsString() || n.IsTrue() || n.IsFalse()
+	}
+	return false
+}
+
+// setScalar writes a value that isScalarValue accepted
+func setScalar(node *insaneJSON.Node, v core.Value) {
+	switch val := v.(type) {
+	case core.NullValue:
+		node.MutateToNull()
+	case core.BoolValue:
+		node.MutateToBool(val.V)
+	case core.IntegerValue:
+		node.MutateToInt64(val.V)
+	case core.FloatValue:
+		node.MutateToFloat(val.V)
+	case core.StringValue:
+		node.MutateToString(val.V)
+	case core.JSONNodeValue:
+		switch n := val.N; {
+		case n == nil || n.IsNull():
+			node.MutateToNull()
+		case n.IsString():
+			node.MutateToString(n.AsString())
+		case n.IsTrue():
+			node.MutateToBool(true)
+		default:
+			node.MutateToBool(false)
+		}
+	}
+}
+
 // digOrCreateParent walks the given parent segments, creating missing object
 // nodes along the way so that nested assignments like `.a.b.c = 1` work even
 // when `.a`/`.a.b` do not yet exist. Index segments are not auto-grown: an
@@ -204,6 +267,21 @@ func toInsaneJSONPath(segments []core.Segment, pathBuffer []string) []string {
 	return pathBuffer
 }
 
+// quoteJSON renders a string as a JSON string literal
+//
+// strconv.Quote is Go quoting, not JSON quoting: it escapes a control character
+// as \x01 and a byte that is not valid UTF-8 as \xff, neither of which JSON
+// accepts; using it here put malformed JSON into the event whenever a log line
+// carried such a byte
+func quoteJSON(s string) string {
+	encoded, err := json.Marshal(s)
+	if err != nil {
+		// json.Marshal only fails on unsupported types, never on a string
+		return strconv.Quote(s)
+	}
+	return string(encoded)
+}
+
 // valueToJSON serializes a core.Value to a JSON string.
 func valueToJSON(v core.Value) (string, error) {
 	switch val := v.(type) {
@@ -219,7 +297,7 @@ func valueToJSON(v core.Value) (string, error) {
 	case core.FloatValue:
 		return strconv.FormatFloat(val.V, 'f', -1, 64), nil
 	case core.StringValue:
-		return strconv.Quote(val.V), nil
+		return quoteJSON(val.V), nil
 	case core.ArrayValue:
 		parts := make([]string, len(val.V))
 		for i, el := range val.V {
@@ -237,7 +315,7 @@ func valueToJSON(v core.Value) (string, error) {
 			if err != nil {
 				return "", err
 			}
-			parts = append(parts, strconv.Quote(k)+":"+s)
+			parts = append(parts, quoteJSON(k)+":"+s)
 		}
 		return "{" + strings.Join(parts, ",") + "}", nil
 	case core.JSONNodeValue:
diff --git a/plugin/action/transform/runtime/set_bench_test.go b/plugin/action/transform/runtime/set_bench_test.go
new file mode 100644
index 000000000..51806b594
--- /dev/null
+++ b/plugin/action/transform/runtime/set_bench_test.go
@@ -0,0 +1,44 @@
+package runtime
+
+import (
+	"testing"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+	insaneJSON "github.com/ozontech/insane-json"
+)
+
+const benchEvent = `{"log":"2025-05-25 11:11:11 INFO billing request processed in 42ms","k8s_node":"node-17","k8s_pod_label_app":"billing","@lt":""}`
+
+// the move-shaped assignments transform #1 performs on every event
+func benchMoves(b *testing.B, root *insaneJSON.Root) {
+	seg := func(f string) core.Path {
+		return core.Path{Segments: []core.Segment{core.FieldSeg(f)}}
+	}
+	for i := 0; i < b.N; i++ {
+		// one iteration == one event: the pipeline decodes into the pooled root,
+		// which resets the decoder's node counter, then the actions run
+		if err := root.DecodeString(benchEvent); err != nil {
+			b.Fatal(err)
+		}
+		tgt := NewRootTarget(root, "src", map[string]string{})
+		src, _ := tgt.Get(seg("log"))
+		_ = tgt.Set(seg("message"), src)
+		src, _ = tgt.Get(seg("k8s_pod_label_app"))
+		_ = tgt.Set(seg("service"), src)
+		src, _ = tgt.Get(seg("k8s_node"))
+		_ = tgt.Set(seg("host"), src)
+		_ = tgt.Set(seg("@lt"), core.StringValue{V: "ok"})
+		_ = tgt.Set(seg("level"), core.IntegerValue{V: 6})
+	}
+}
+
+func BenchmarkSetMoves(b *testing.B) {
+	root, err := insaneJSON.DecodeString(benchEvent)
+	if err != nil {
+		b.Fatal(err)
+	}
+	defer insaneJSON.Release(root)
+	b.ReportAllocs()
+	b.ResetTimer()
+	benchMoves(b, root)
+}
diff --git a/plugin/action/transform/runtime/set_fastpath_test.go b/plugin/action/transform/runtime/set_fastpath_test.go
new file mode 100644
index 000000000..fa5fbd577
--- /dev/null
+++ b/plugin/action/transform/runtime/set_fastpath_test.go
@@ -0,0 +1,171 @@
+package runtime
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+	insaneJSON "github.com/ozontech/insane-json"
+	"github.com/stretchr/testify/require"
+)
+
+// setViaJSON is what Set did before the scalar fast path: always serialize the
+// value and parse it back; it is the reference the fast path must match
+func setViaJSON(t *testing.T, root *insaneJSON.Root, field string, v core.Value) string {
+	t.Helper()
+	encoded, err := valueToJSON(v)
+	require.NoError(t, err)
+	node := root.Dig(field)
+	if node == nil {
+		node = root.AddFieldNoAlloc(root, field)
+	}
+	node.MutateToJSON(root, encoded)
+	return root.EncodeToString()
+}
+
+func setViaTarget(t *testing.T, root *insaneJSON.Root, field string, v core.Value) string {
+	t.Helper()
+	tgt := NewRootTarget(root, "src", map[string]string{})
+	require.NoError(t, tgt.Set(core.Path{Segments: []core.Segment{core.FieldSeg(field)}}, v))
+	return root.EncodeToString()
+}
+
+// every value the language can assign must land in the event identically
+// whether it took the fast path or the JSON round trip
+func TestSetFastPathMatchesJSONPath(t *testing.T) {
+	// literal values produced by the language itself
+	literals := []core.Value{
+		core.NullValue{},
+		core.BoolValue{V: true},
+		core.BoolValue{V: false},
+		core.IntegerValue{V: 0},
+		core.IntegerValue{V: -42},
+		core.IntegerValue{V: 9007199254740993},
+		core.FloatValue{V: 3.14},
+		core.FloatValue{V: -0.5},
+		core.StringValue{V: ""},
+		core.StringValue{V: "plain"},
+		core.StringValue{V: `quote " and backslash \`},
+		core.StringValue{V: "line\nbreak\ttab"},
+		core.StringValue{V: "юникод и эмодзи 🎯"},
+		core.StringValue{V: `{"looks":"like json"}`},
+		core.StringValue{V: "control\x01char"},
+		core.StringValue{V: "\x00null byte"},
+		core.ArrayValue{V: []core.Value{core.IntegerValue{V: 1}, core.StringValue{V: "two"}}},
+		core.ObjectValue{V: map[string]core.Value{"k": core.StringValue{V: "v"}}},
+	}
+
+	for i, v := range literals {
+		t.Run(fmt.Sprintf("literal_%d_%s", i, v.Kind()), func(t *testing.T) {
+			a, err := insaneJSON.DecodeString(`{"keep":1}`)
+			require.NoError(t, err)
+			defer insaneJSON.Release(a)
+
+			b, err := insaneJSON.DecodeString(`{"keep":1}`)
+			require.NoError(t, err)
+			defer insaneJSON.Release(b)
+
+			out := fmt.Sprintf("out %d", i)
+			want := setViaJSON(t, a, out, v)
+			got := setViaTarget(t, b, out, v)
+			require.Equal(t, want, got)
+			require.True(t, json.Valid([]byte(got)), "produced invalid JSON: %s", got)
+		})
+	}
+
+	// values read back out of an event, which is what `.a = .b` produces
+	sources := []string{
+		`"plain"`,
+		`""`,
+		`"quote \" and backslash \\"`,
+		`"line\nbreak\ttab"`,
+		`"юникод и эмодзи 🎯"`,
+		`"Aé🎯"`,
+		`true`,
+		`false`,
+		`null`,
+		`0`,
+		`-42`,
+		`1.50`,
+		`1e3`,
+		`9007199254740993`,
+		`{"nested":{"deep":[1,2,3]}}`,
+		`[1,"two",null,{"k":"v"}]`,
+		`[]`,
+		`{}`,
+	}
+
+	for i, src := range sources {
+		t.Run(fmt.Sprintf("node_%d", i), func(t *testing.T) {
+			doc := fmt.Sprintf(`{"keep":1,"src":%s}`, src)
+
+			a, err := insaneJSON.DecodeString(doc)
+			require.NoError(t, err)
+			defer insaneJSON.Release(a)
+
+			b, err := insaneJSON.DecodeString(doc)
+			require.NoError(t, err)
+			defer insaneJSON.Release(b)
+
+			require.Equal(t,
+				setViaJSON(t, a, "out", core.JSONNodeValue{N: a.Dig("src")}),
+				setViaTarget(t, b, "out", core.JSONNodeValue{N: b.Dig("src")}),
+				"source %s", src)
+		})
+	}
+}
+
+// a string carrying bytes that are not valid UTF-8 is the one case where the two
+// paths still differ, and the split is inside insane-json rather than here:
+// escapeString emits \ufffd for an invalid rune, but the shouldEscape check in
+// front of it lets a string through untouched when it holds no quote, backslash
+// or control byte; so the fast path keeps the original bytes -- which is what the
+// rest of file.d does with log data -- while the JSON path sanitizes them
+// both are well-formed JSON structure; neither loses the event
+func TestSetFastPathInvalidUTF8(t *testing.T) {
+	const bad = "bad\xff\xfeutf8"
+
+	a, err := insaneJSON.DecodeString(`{"keep":1}`)
+	require.NoError(t, err)
+	defer insaneJSON.Release(a)
+
+	b, err := insaneJSON.DecodeString(`{"keep":1}`)
+	require.NoError(t, err)
+	defer insaneJSON.Release(b)
+
+	viaJSON := setViaJSON(t, a, "out", core.StringValue{V: bad})
+	viaFast := setViaTarget(t, b, "out", core.StringValue{V: bad})
+
+	require.Equal(t, `{"keep":1,"out":"bad\ufffd\ufffdutf8"}`, viaJSON)
+	require.Equal(t, "{\"keep\":1,\"out\":\"bad\xff\xfeutf8\"}", viaFast)
+}
+
+// overwriting an existing field must behave the same on both paths, including
+// when a composite is replaced by a scalar and vice versa
+func TestSetFastPathOverwrite(t *testing.T) {
+	cases := []struct {
+		doc string
+		val core.Value
+	}{
+		{`{"out":"old"}`, core.StringValue{V: "new"}},
+		{`{"out":{"a":1}}`, core.StringValue{V: "new"}},
+		{`{"out":[1,2,3]}`, core.NullValue{}},
+		{`{"out":"old"}`, core.ArrayValue{V: []core.Value{core.IntegerValue{V: 1}}}},
+		{`{"out":null}`, core.BoolValue{V: true}},
+	}
+
+	for i, c := range cases {
+		t.Run(fmt.Sprintf("overwrite_%d", i), func(t *testing.T) {
+			a, err := insaneJSON.DecodeString(c.doc)
+			require.NoError(t, err)
+			defer insaneJSON.Release(a)
+
+			b, err := insaneJSON.DecodeString(c.doc)
+			require.NoError(t, err)
+			defer insaneJSON.Release(b)
+
+			require.Equal(t, setViaJSON(t, a, "out", c.val), setViaTarget(t, b, "out", c.val))
+		})
+	}
+}
diff --git a/plugin/action/transform/stdlib/capture.go b/plugin/action/transform/stdlib/capture.go
deleted file mode 100644
index cadba51d7..000000000
--- a/plugin/action/transform/stdlib/capture.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package stdlib
-
-import (
-	"github.com/ozontech/file.d/plugin/action/transform/core"
-)
-
-// capture matches value against a regular expression and returns an object of
-// its named capture groups (keyed by group name). Unnamed groups are ignored.
-// When value does not match, it returns null so callers can guard the result
-// with `if m != null { ... }`.
-type capture struct{}
-
-func (capture) Name() string { return "capture" }
-
-func (capture) Params() []Parameter {
-	return []Parameter{
-		{
-			Name:          "value",
-			Description:   "The string to match.",
-			AcceptedKinds: []core.ValueKind{core.KindString},
-		},
-		{
-			Name:          "pattern",
-			Description:   "The regular expression; named groups (?P<name>...) become object keys.",
-			AcceptedKinds: []core.ValueKind{core.KindRegex},
-		},
-	}
-}
-
-func (capture) Call(args map[string]core.Value) (core.Value, error) {
-	value := args["value"].(core.StringValue)
-	re := args["pattern"].(core.RegexValue).V
-
-	match := re.FindStringSubmatch(value.V)
-	if match == nil {
-		return core.NullValue{}, nil
-	}
-
-	names := re.SubexpNames()
-	groups := make(map[string]core.Value)
-	for i, name := range names {
-		// names[0] is the whole match (always unnamed); unnamed groups have "".
-		if i == 0 || name == "" {
-			continue
-		}
-		groups[name] = core.StringValue{V: match[i]}
-	}
-
-	return core.ObjectValue{V: groups}, nil
-}
diff --git a/plugin/action/transform/stdlib/capture_test.go b/plugin/action/transform/stdlib/capture_test.go
deleted file mode 100644
index a6ebde8d8..000000000
--- a/plugin/action/transform/stdlib/capture_test.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package stdlib
-
-import (
-	"regexp"
-	"testing"
-
-	"github.com/ozontech/file.d/plugin/action/transform/core"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func callCapture(value, pattern string) (core.Value, error) {
-	re := regexp.MustCompile(pattern)
-	return capture{}.Call(map[string]core.Value{
-		"value":   core.StringValue{V: value},
-		"pattern": core.RegexValue{V: re},
-	})
-}
-
-func TestCapture(t *testing.T) {
-	t.Parallel()
-
-	t.Run("scylla_line", func(t *testing.T) {
-		t.Parallel()
-
-		line := `INFO 2025-05-25 18:18:18,180 [shard 4:comp] compaction - [Compact xxxx] Compacted 4 sstables`
-		pattern := `^(?P<level>\S+)\s+(?P<date>\d{4}-\d{2}-\d{2})\s+(?P<time>[\d:,]+)\s+\[(?P<shard>[^\]]*)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.*)$`
-
-		got, err := callCapture(line, pattern)
-		require.NoError(t, err)
-		obj, ok := got.(core.ObjectValue)
-		require.True(t, ok)
-
-		assert.Equal(t, core.StringValue{V: "INFO"}, obj.V["level"])
-		assert.Equal(t, core.StringValue{V: "2025-05-25"}, obj.V["date"])
-		assert.Equal(t, core.StringValue{V: "18:18:18,180"}, obj.V["time"])
-		assert.Equal(t, core.StringValue{V: "shard 4:comp"}, obj.V["shard"])
-		assert.Equal(t, core.StringValue{V: "compaction"}, obj.V["operation"])
-		assert.Equal(t, core.StringValue{V: "[Compact xxxx] Compacted 4 sstables"}, obj.V["message"])
-	})
-
-	t.Run("cassandra_line", func(t *testing.T) {
-		t.Parallel()
-
-		line := `INFO [3-19] 2025-05-25 11:11:11,999 NoSpamLogger.java:104 - /11.111.111.111:2222 failed to connect`
-		pattern := `^(?P<level>\S+)\s+\[(?P<operation>[^\]]*)\]\s+(?P<date>\d{4}-\d{2}-\d{2})\s+(?P<time>[\d:,]+)\s+\S+\s+-\s+(?P<message>.*)$`
-
-		got, err := callCapture(line, pattern)
-		require.NoError(t, err)
-		obj, ok := got.(core.ObjectValue)
-		require.True(t, ok)
-
-		assert.Equal(t, core.StringValue{V: "INFO"}, obj.V["level"])
-		assert.Equal(t, core.StringValue{V: "3-19"}, obj.V["operation"])
-		assert.Equal(t, core.StringValue{V: "2025-05-25"}, obj.V["date"])
-		assert.Equal(t, core.StringValue{V: "11:11:11,999"}, obj.V["time"])
-		assert.Equal(t, core.StringValue{V: "/11.111.111.111:2222 failed to connect"}, obj.V["message"])
-	})
-
-	t.Run("no_match_returns_null", func(t *testing.T) {
-		t.Parallel()
-
-		got, err := callCapture("nothing here", `^(?P<level>INFO)$`)
-		require.NoError(t, err)
-		assert.Equal(t, core.NullValue{}, got)
-	})
-
-	t.Run("unnamed_groups_ignored", func(t *testing.T) {
-		t.Parallel()
-
-		got, err := callCapture("abc123", `(?P<letters>[a-z]+)(\d+)`)
-		require.NoError(t, err)
-		obj, ok := got.(core.ObjectValue)
-		require.True(t, ok)
-
-		assert.Equal(t, core.StringValue{V: "abc"}, obj.V["letters"])
-		assert.Len(t, obj.V, 1, "unnamed group must not appear in the result")
-	})
-}
diff --git a/plugin/action/transform/stdlib/join.go b/plugin/action/transform/stdlib/join.go
new file mode 100644
index 000000000..b208e657f
--- /dev/null
+++ b/plugin/action/transform/stdlib/join.go
@@ -0,0 +1,51 @@
+package stdlib
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+)
+
+// join concatenates an array of strings into one string:
+//
+//	join(parse_regex_all(.log, r're\d+'), ",")   -> "re1,re2"
+//
+// only strings are joined; like the + operator, other kinds must be converted
+// with to_string() first, so a surprising array does not silently produce a
+// surprising field
+type join struct{}
+
+func (join) Name() string { return "join" }
+
+func (join) Params() []Parameter {
+	return []Parameter{
+		{
+			Name:          "value",
+			Description:   "The array of strings to join.",
+			AcceptedKinds: []core.ValueKind{core.KindArray},
+		},
+		{
+			Name:          "separator",
+			Description:   `Placed between elements; pass "" to concatenate them directly.`,
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+	}
+}
+
+func (join) Call(args map[string]core.Value) (core.Value, error) {
+	elements := args["value"].(core.ArrayValue).V
+	separator := args["separator"].(core.StringValue).V
+
+	parts := make([]string, len(elements))
+	for i, el := range elements {
+		s, ok := el.(core.StringValue)
+		if !ok {
+			return core.NullValue{}, fmt.Errorf(
+				"element %d: expected string, got %s", i, el.Kind())
+		}
+		parts[i] = s.V
+	}
+
+	return core.StringValue{V: strings.Join(parts, separator)}, nil
+}
diff --git a/plugin/action/transform/stdlib/join_test.go b/plugin/action/transform/stdlib/join_test.go
new file mode 100644
index 000000000..f8d9e51b2
--- /dev/null
+++ b/plugin/action/transform/stdlib/join_test.go
@@ -0,0 +1,42 @@
+package stdlib
+
+import (
+	"testing"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestJoin(t *testing.T) {
+	t.Parallel()
+
+	call := func(elements []core.Value, separator string) (core.Value, error) {
+		return callFn(join{}, []core.Value{core.ArrayValue{V: elements}, str(separator)}, nil)
+	}
+	mustCall := func(t *testing.T, elements []core.Value, separator string) string {
+		t.Helper()
+		got, err := call(elements, separator)
+		require.NoError(t, err)
+		return got.(core.StringValue).V
+	}
+
+	t.Run("separator", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, "re1,re2", mustCall(t, []core.Value{str("re1"), str("re2")}, ","))
+		assert.Equal(t, "re1re2", mustCall(t, []core.Value{str("re1"), str("re2")}, ""))
+	})
+
+	t.Run("edge_cases", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, "", mustCall(t, nil, ","), "empty array")
+		assert.Equal(t, "only", mustCall(t, []core.Value{str("only")}, ","), "no separator for one element")
+		assert.Equal(t, ",", mustCall(t, []core.Value{str(""), str("")}, ","), "empty elements are kept")
+	})
+
+	t.Run("rejects_non_strings", func(t *testing.T) {
+		t.Parallel()
+		_, err := call([]core.Value{str("a"), core.IntegerValue{V: 1}}, ",")
+		require.ErrorContains(t, err, "element 1: expected string, got integer")
+	})
+}
diff --git a/plugin/action/transform/stdlib/parse_regex.go b/plugin/action/transform/stdlib/parse_regex.go
new file mode 100644
index 000000000..9709bbeec
--- /dev/null
+++ b/plugin/action/transform/stdlib/parse_regex.go
@@ -0,0 +1,66 @@
+package stdlib
+
+import (
+	"strconv"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+)
+
+// parse_regex matches value against a regular expression and returns an object
+// of its named capture groups (keyed by group name); unnamed groups are ignored
+// when value does not match, it returns null so callers can guard the result
+// with `if m != null { ... }`
+//
+// with numeric_groups enabled every group is additionally keyed by its index as
+// a string - "0" is the whole match, "1" the first group and so on - which is
+// how a pattern without named groups is read: m["1"]
+type parseRegex struct{}
+
+func (parseRegex) Name() string { return "parse_regex" }
+
+func (parseRegex) Params() []Parameter {
+	return []Parameter{
+		{
+			Name:          "value",
+			Description:   "The string to match.",
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+		{
+			Name:          "pattern",
+			Description:   "The regular expression; named groups (?P<name>...) become object keys.",
+			AcceptedKinds: []core.ValueKind{core.KindRegex},
+		},
+		{
+			Name:          "numeric_groups",
+			Description:   `Also key every group by its index as a string: "0" is the whole match, "1" the first group.`,
+			Default:       core.BoolValue{V: false},
+			AcceptedKinds: []core.ValueKind{core.KindBool},
+		},
+	}
+}
+
+func (parseRegex) Call(args map[string]core.Value) (core.Value, error) {
+	value := args["value"].(core.StringValue)
+	re := args["pattern"].(core.RegexValue).V
+	numericGroups := args["numeric_groups"].(core.BoolValue).V
+
+	match := re.FindStringSubmatch(value.V)
+	if match == nil {
+		return core.NullValue{}, nil
+	}
+
+	names := re.SubexpNames()
+	groups := make(map[string]core.Value)
+	for i, name := range names {
+		if numericGroups {
+			groups[strconv.Itoa(i)] = core.StringValue{V: match[i]}
+		}
+		// names[0] is the whole match (always unnamed); unnamed groups have ""
+		if i == 0 || name == "" {
+			continue
+		}
+		groups[name] = core.StringValue{V: match[i]}
+	}
+
+	return core.ObjectValue{V: groups}, nil
+}
diff --git a/plugin/action/transform/stdlib/parse_regex_all.go b/plugin/action/transform/stdlib/parse_regex_all.go
new file mode 100644
index 000000000..80068ee67
--- /dev/null
+++ b/plugin/action/transform/stdlib/parse_regex_all.go
@@ -0,0 +1,81 @@
+package stdlib
+
+import (
+	"fmt"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+)
+
+// parse_regex_all collects every match of a pattern in a string and returns
+// them as an array; it is the multi-occurrence counterpart of parse_regex:
+// parse_regex describes one match by its groups, parse_regex_all describes many
+// matches by a single group
+//
+//	parse_regex_all(.log, r'\d+')                     -> ["1", "42"]
+//	join(parse_regex_all(.log, r're\d+', limit: 2), ",") -> "re1,re2"
+//
+// when nothing matches an empty array is returned, so the result is always safe
+// to iterate or join
+type parseRegexAll struct{}
+
+func (parseRegexAll) Name() string { return "parse_regex_all" }
+
+func (parseRegexAll) Params() []Parameter {
+	return []Parameter{
+		{
+			Name:          "value",
+			Description:   "The string to search.",
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+		{
+			Name:          "pattern",
+			Description:   "The regular expression to search for.",
+			AcceptedKinds: []core.ValueKind{core.KindRegex},
+		},
+		{
+			Name:          "group",
+			Description:   "Index of the capture group to collect; 0 is the whole match.",
+			Default:       core.IntegerValue{V: 0},
+			AcceptedKinds: []core.ValueKind{core.KindInteger},
+		},
+		{
+			Name:          "limit",
+			Description:   "Maximum number of matches to collect; a negative limit collects all of them.",
+			Default:       core.IntegerValue{V: -1},
+			AcceptedKinds: []core.ValueKind{core.KindInteger},
+		},
+	}
+}
+
+func (parseRegexAll) Call(args map[string]core.Value) (core.Value, error) {
+	value := args["value"].(core.StringValue).V
+	re := args["pattern"].(core.RegexValue).V
+	group := int(args["group"].(core.IntegerValue).V)
+	limit := int(args["limit"].(core.IntegerValue).V)
+
+	if group < 0 || group > re.NumSubexp() {
+		return core.NullValue{}, fmt.Errorf(
+			"group %d is out of range: pattern has %d capture groups", group, re.NumSubexp())
+	}
+
+	// a negative limit means "all matches"; Go spells that -1 exactly
+	if limit < 0 {
+		limit = -1
+	}
+
+	// the index form is used rather than FindAllStringSubmatch so that a group
+	// that did not participate in a match (-1) can be told apart from a group
+	// that matched an empty string, and skipped
+	matches := re.FindAllStringSubmatchIndex(value, limit)
+
+	result := make([]core.Value, 0, len(matches))
+	for _, match := range matches {
+		start, end := match[group*2], match[group*2+1]
+		if start == -1 || end == -1 {
+			continue
+		}
+		result = append(result, core.StringValue{V: value[start:end]})
+	}
+
+	return core.ArrayValue{V: result}, nil
+}
diff --git a/plugin/action/transform/stdlib/parse_regex_all_test.go b/plugin/action/transform/stdlib/parse_regex_all_test.go
new file mode 100644
index 000000000..1bf3a227c
--- /dev/null
+++ b/plugin/action/transform/stdlib/parse_regex_all_test.go
@@ -0,0 +1,89 @@
+package stdlib
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func callParseRegexAll(t *testing.T, value, pattern string, named map[string]core.Value) []string {
+	t.Helper()
+
+	got, err := callFn(parseRegexAll{}, []core.Value{
+		core.StringValue{V: value},
+		core.RegexValue{V: regexp.MustCompile(pattern)},
+	}, named)
+	require.NoError(t, err)
+
+	arr, ok := got.(core.ArrayValue)
+	require.True(t, ok, "expected an array, got %s", got.Kind())
+
+	out := make([]string, len(arr.V))
+	for i, el := range arr.V {
+		out[i] = el.(core.StringValue).V
+	}
+	return out
+}
+
+func TestParseRegexAll(t *testing.T) {
+	t.Parallel()
+
+	t.Run("whole_matches", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, []string{"re1", "re2", "re3", "re4"},
+			callParseRegexAll(t, "re1 re2 re3 re4", `re\d+`, nil))
+	})
+
+	t.Run("capture_group", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, []string{"1", "2"},
+			callParseRegexAll(t, "re1 re2", `re(\d+)`, map[string]core.Value{"group": core.IntegerValue{V: 1}}))
+	})
+
+	t.Run("limit", func(t *testing.T) {
+		t.Parallel()
+
+		assert.Equal(t, []string{"re1", "re2"},
+			callParseRegexAll(t, "re1 re2 re3 re4", `re\d+`, map[string]core.Value{"limit": core.IntegerValue{V: 2}}),
+			"a positive limit caps the number of matches")
+
+		assert.Empty(t, callParseRegexAll(t, "re1 re2", `re\d+`, map[string]core.Value{"limit": core.IntegerValue{V: 0}}),
+			"limit 0 extracts nothing, as in the modify plugin")
+
+		assert.Equal(t, []string{"re1", "re2"},
+			callParseRegexAll(t, "re1 re2", `re\d+`, map[string]core.Value{"limit": core.IntegerValue{V: -5}}),
+			"any negative limit means all matches")
+	})
+
+	t.Run("no_match", func(t *testing.T) {
+		t.Parallel()
+		assert.Empty(t, callParseRegexAll(t, "nothing here", `re\d+`, nil))
+		assert.Empty(t, callParseRegexAll(t, "", `re\d+`, nil), "empty input")
+	})
+
+	t.Run("skips_groups_that_did_not_participate", func(t *testing.T) {
+		t.Parallel()
+		// group 1 participates only in the "a" match, not in the "b" one
+		assert.Equal(t, []string{"a"},
+			callParseRegexAll(t, "a b", `(a)|(b)`, map[string]core.Value{"group": core.IntegerValue{V: 1}}))
+	})
+
+	t.Run("group_out_of_range", func(t *testing.T) {
+		t.Parallel()
+
+		call := func(group int64) error {
+			_, err := callFn(parseRegexAll{}, []core.Value{
+				core.StringValue{V: "re1"},
+				core.RegexValue{V: regexp.MustCompile(`re(\d+)`)},
+			}, map[string]core.Value{"group": core.IntegerValue{V: group}})
+			return err
+		}
+
+		require.ErrorContains(t, call(2), "out of range")
+		require.ErrorContains(t, call(-1), "out of range")
+		require.NoError(t, call(1), "the last valid group is accepted")
+	})
+}
diff --git a/plugin/action/transform/stdlib/parse_regex_test.go b/plugin/action/transform/stdlib/parse_regex_test.go
new file mode 100644
index 000000000..8d40982ae
--- /dev/null
+++ b/plugin/action/transform/stdlib/parse_regex_test.go
@@ -0,0 +1,141 @@
+package stdlib
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func callParseRegex(value, pattern string) (core.Value, error) {
+	return callParseRegexNamed(value, pattern, nil)
+}
+
+func callParseRegexNamed(value, pattern string, named map[string]core.Value) (core.Value, error) {
+	re := regexp.MustCompile(pattern)
+	return callFn(parseRegex{}, []core.Value{
+		core.StringValue{V: value},
+		core.RegexValue{V: re},
+	}, named)
+}
+
+func TestParseRegex(t *testing.T) {
+	t.Parallel()
+
+	t.Run("scylla_line", func(t *testing.T) {
+		t.Parallel()
+
+		line := `INFO 2025-05-25 18:18:18,180 [shard 4:comp] compaction - [Compact xxxx] Compacted 4 sstables`
+		pattern := `^(?P<level>\S+)\s+(?P<date>\d{4}-\d{2}-\d{2})\s+(?P<time>[\d:,]+)\s+\[(?P<shard>[^\]]*)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.*)$`
+
+		got, err := callParseRegex(line, pattern)
+		require.NoError(t, err)
+		obj, ok := got.(core.ObjectValue)
+		require.True(t, ok)
+
+		assert.Equal(t, core.StringValue{V: "INFO"}, obj.V["level"])
+		assert.Equal(t, core.StringValue{V: "2025-05-25"}, obj.V["date"])
+		assert.Equal(t, core.StringValue{V: "18:18:18,180"}, obj.V["time"])
+		assert.Equal(t, core.StringValue{V: "shard 4:comp"}, obj.V["shard"])
+		assert.Equal(t, core.StringValue{V: "compaction"}, obj.V["operation"])
+		assert.Equal(t, core.StringValue{V: "[Compact xxxx] Compacted 4 sstables"}, obj.V["message"])
+	})
+
+	t.Run("cassandra_line", func(t *testing.T) {
+		t.Parallel()
+
+		line := `INFO [3-19] 2025-05-25 11:11:11,999 NoSpamLogger.java:104 - /11.111.111.111:2222 failed to connect`
+		pattern := `^(?P<level>\S+)\s+\[(?P<operation>[^\]]*)\]\s+(?P<date>\d{4}-\d{2}-\d{2})\s+(?P<time>[\d:,]+)\s+\S+\s+-\s+(?P<message>.*)$`
+
+		got, err := callParseRegex(line, pattern)
+		require.NoError(t, err)
+		obj, ok := got.(core.ObjectValue)
+		require.True(t, ok)
+
+		assert.Equal(t, core.StringValue{V: "INFO"}, obj.V["level"])
+		assert.Equal(t, core.StringValue{V: "3-19"}, obj.V["operation"])
+		assert.Equal(t, core.StringValue{V: "2025-05-25"}, obj.V["date"])
+		assert.Equal(t, core.StringValue{V: "11:11:11,999"}, obj.V["time"])
+		assert.Equal(t, core.StringValue{V: "/11.111.111.111:2222 failed to connect"}, obj.V["message"])
+	})
+
+	t.Run("no_match_returns_null", func(t *testing.T) {
+		t.Parallel()
+
+		got, err := callParseRegex("nothing here", `^(?P<level>INFO)$`)
+		require.NoError(t, err)
+		assert.Equal(t, core.NullValue{}, got)
+	})
+
+	t.Run("unnamed_groups_ignored", func(t *testing.T) {
+		t.Parallel()
+
+		got, err := callParseRegex("abc123", `(?P<letters>[a-z]+)(\d+)`)
+		require.NoError(t, err)
+		obj, ok := got.(core.ObjectValue)
+		require.True(t, ok)
+
+		assert.Equal(t, core.StringValue{V: "abc"}, obj.V["letters"])
+		assert.Len(t, obj.V, 1, "unnamed group must not appear in the result")
+	})
+}
+
+func TestParseRegexNumericGroups(t *testing.T) {
+	t.Parallel()
+
+	enabled := map[string]core.Value{"numeric_groups": core.BoolValue{V: true}}
+
+	t.Run("positional_groups_are_keyed_by_index", func(t *testing.T) {
+		t.Parallel()
+
+		// modify README: ${message|re("service=(\S+) exec took (\d+\.?\d*(?:ms|s|m|h))",-1,[2],",")}
+		got, err := callParseRegexNamed(
+			"service=service-test-1 exec took 200ms",
+			`service=(\S+) exec took (\d+\.?\d*(?:ms|s|m|h))`,
+			enabled,
+		)
+		require.NoError(t, err)
+		obj, ok := got.(core.ObjectValue)
+		require.True(t, ok)
+
+		assert.Equal(t, core.StringValue{V: "service=service-test-1 exec took 200ms"}, obj.V["0"],
+			`"0" is the whole match`)
+		assert.Equal(t, core.StringValue{V: "service-test-1"}, obj.V["1"])
+		assert.Equal(t, core.StringValue{V: "200ms"}, obj.V["2"])
+	})
+
+	t.Run("named_groups_are_keyed_both_ways", func(t *testing.T) {
+		t.Parallel()
+
+		got, err := callParseRegexNamed("abc123", `(?P<letters>[a-z]+)(\d+)`, enabled)
+		require.NoError(t, err)
+		obj, ok := got.(core.ObjectValue)
+		require.True(t, ok)
+
+		assert.Equal(t, core.StringValue{V: "abc"}, obj.V["letters"])
+		assert.Equal(t, core.StringValue{V: "abc"}, obj.V["1"])
+		assert.Equal(t, core.StringValue{V: "123"}, obj.V["2"], "unnamed groups become reachable")
+	})
+
+	t.Run("off_by_default", func(t *testing.T) {
+		t.Parallel()
+
+		got, err := callParseRegex("abc123", `(?P<letters>[a-z]+)(\d+)`)
+		require.NoError(t, err)
+		obj, ok := got.(core.ObjectValue)
+		require.True(t, ok)
+
+		assert.NotContains(t, obj.V, "0")
+		assert.NotContains(t, obj.V, "1")
+	})
+
+	t.Run("no_match_still_returns_null", func(t *testing.T) {
+		t.Parallel()
+
+		got, err := callParseRegexNamed("nothing here", `^(INFO)$`, enabled)
+		require.NoError(t, err)
+		assert.Equal(t, core.NullValue{}, got)
+	})
+}
diff --git a/plugin/action/transform/stdlib/registry.go b/plugin/action/transform/stdlib/registry.go
index f7e6f9740..87af0cb79 100644
--- a/plugin/action/transform/stdlib/registry.go
+++ b/plugin/action/transform/stdlib/registry.go
@@ -16,11 +16,20 @@ func init() {
 	registry = newRegistry()
 
 	registry.mustRegister(upcase{})
-	registry.mustRegister(capture{})
+	registry.mustRegister(parseRegex{})
 	registry.mustRegister(toString{})
 	registry.mustRegister(after{})
 	registry.mustRegister(before{})
 	registry.mustRegister(between{})
+	registry.mustRegister(parseRegexAll{})
+	registry.mustRegister(join{})
+	registry.mustRegister(trim{})
+	registry.mustRegister(trimLeft{})
+	registry.mustRegister(trimRight{})
+	registry.mustRegister(trimTo{})
+	registry.mustRegister(trimToLeft{})
+	registry.mustRegister(trimToRight{})
+	registry.mustRegister(slice{})
 	registry.mustRegister(lookup{})
 }
 
diff --git a/plugin/action/transform/stdlib/resolve_test.go b/plugin/action/transform/stdlib/resolve_test.go
index 123c1f0fd..0353be833 100644
--- a/plugin/action/transform/stdlib/resolve_test.go
+++ b/plugin/action/transform/stdlib/resolve_test.go
@@ -35,6 +35,21 @@ func resolveArgs(t *testing.T, fn Function, positional []core.Value, named map[s
 	return c.Resolve(positional, named)
 }
 
+// callFn invokes fn the way the interpreter does: arguments are bound through
+// the compiled signature, so omitted named parameters get their declared
+// defaults instead of being absent from the map
+func callFn(fn Function, positional []core.Value, named map[string]core.Value) (core.Value, error) {
+	c, err := compile(fn)
+	if err != nil {
+		return nil, err
+	}
+	resolved, err := c.Resolve(positional, named)
+	if err != nil {
+		return nil, err
+	}
+	return c.Call(resolved)
+}
+
 func TestJoinKinds(t *testing.T) {
 	t.Parallel()
 
diff --git a/plugin/action/transform/stdlib/slice.go b/plugin/action/transform/stdlib/slice.go
new file mode 100644
index 000000000..27f6c050b
--- /dev/null
+++ b/plugin/action/transform/stdlib/slice.go
@@ -0,0 +1,71 @@
+package stdlib
+
+import (
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+)
+
+// slice returns the part of a string between two positions, counted in
+// characters rather than bytes so multi-byte text is never cut in half:
+//
+//	slice(.message, 0, end: 10)   -> the first 10 characters
+//	slice(.message, -5)           -> the last 5 characters
+//
+// start is inclusive, end is exclusive, and both may be negative to count from
+// the right; positions outside the string are clamped instead of raising an
+// error, so a shorter-than-expected line passes through whole
+type slice struct{}
+
+func (slice) Name() string { return "slice" }
+
+func (slice) Params() []Parameter {
+	return []Parameter{
+		{
+			Name:          "value",
+			Description:   "The string to slice.",
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+		{
+			Name:          "start",
+			Description:   "Inclusive start position; negative counts from the end of the string.",
+			AcceptedKinds: []core.ValueKind{core.KindInteger},
+		},
+		{
+			Name:          "end",
+			Description:   "Exclusive end position; negative counts from the end. Defaults to the end of the string.",
+			Default:       core.NullValue{},
+			AcceptedKinds: []core.ValueKind{core.KindInteger, core.KindNull},
+		},
+	}
+}
+
+func (slice) Call(args map[string]core.Value) (core.Value, error) {
+	runes := []rune(args["value"].(core.StringValue).V)
+	length := len(runes)
+
+	start := clampIndex(int(args["start"].(core.IntegerValue).V), length)
+
+	end := length
+	if v, ok := args["end"].(core.IntegerValue); ok {
+		end = clampIndex(int(v.V), length)
+	}
+
+	if end <= start {
+		return core.StringValue{V: ""}, nil
+	}
+	return core.StringValue{V: string(runes[start:end])}, nil
+}
+
+// clampIndex resolves a possibly negative position against length and pins the
+// result to [0, length]
+func clampIndex(i, length int) int {
+	if i < 0 {
+		i += length
+	}
+	if i < 0 {
+		return 0
+	}
+	if i > length {
+		return length
+	}
+	return i
+}
diff --git a/plugin/action/transform/stdlib/slice_test.go b/plugin/action/transform/stdlib/slice_test.go
new file mode 100644
index 000000000..5eb3eb045
--- /dev/null
+++ b/plugin/action/transform/stdlib/slice_test.go
@@ -0,0 +1,55 @@
+package stdlib
+
+import (
+	"testing"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSlice(t *testing.T) {
+	t.Parallel()
+
+	call := func(value string, start int64, end ...int64) string {
+		named := map[string]core.Value{}
+		if len(end) > 0 {
+			named["end"] = core.IntegerValue{V: end[0]}
+		}
+		got, err := callFn(slice{}, []core.Value{str(value), core.IntegerValue{V: start}}, named)
+		require.NoError(t, err)
+		return got.(core.StringValue).V
+	}
+
+	t.Run("modify_cut_equivalents", func(t *testing.T) {
+		t.Parallel()
+		// modify README: ${message|cut("first",10)} and ${message|cut("last",5)}
+		assert.Equal(t, "some loooo", call("some looooooooooooong data", 0, 10))
+		assert.Equal(t, " data", call("some looooooooooooong data", -5))
+	})
+
+	t.Run("positions", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, "califrag", call("Supercalifragilistic", 5, 13))
+		assert.Equal(t, "listic", call("Supercalifragilistic", -6))
+		assert.Equal(t, "fragilistic", call("Supercalifragilistic", 9))
+		assert.Equal(t, "Supercalifragilistic", call("Supercalifragilistic", 0))
+	})
+
+	t.Run("out_of_range_is_clamped", func(t *testing.T) {
+		t.Parallel()
+		assert.Equal(t, "short", call("short", 0, 100), "end past the string returns what is there")
+		assert.Equal(t, "short", call("short", -100), "start before the string starts at 0")
+		assert.Equal(t, "", call("short", 100), "start past the string yields nothing")
+		assert.Equal(t, "", call("short", 3, 1), "end before start yields nothing")
+		assert.Equal(t, "", call("short", 2, 2), "empty range")
+		assert.Equal(t, "", call("", 0, 5), "empty input")
+	})
+
+	t.Run("counts_characters_not_bytes", func(t *testing.T) {
+		t.Parallel()
+		// the modify plugin's cut counts bytes and would split these runes
+		assert.Equal(t, "привет", call("привет мир", 0, 6))
+		assert.Equal(t, "мир", call("привет мир", -3))
+	})
+}
diff --git a/plugin/action/transform/stdlib/to_string.go b/plugin/action/transform/stdlib/to_string.go
index 89fbd545e..dda5223f6 100644
--- a/plugin/action/transform/stdlib/to_string.go
+++ b/plugin/action/transform/stdlib/to_string.go
@@ -5,13 +5,13 @@ import (
 )
 
 // toString converts any value to its string representation, e.g. for building
-// strings from non-string fields: "code " + string(.code).
+// strings from non-string fields: "code " + to_string(.code)
 //
 // null converts to an empty string (not "null") so that templating over a
 // missing field yields the same empty result as the modify plugin.
 type toString struct{}
 
-func (toString) Name() string { return "string" }
+func (toString) Name() string { return "to_string" }
 
 func (toString) Params() []Parameter {
 	return []Parameter{
diff --git a/plugin/action/transform/stdlib/trim.go b/plugin/action/transform/stdlib/trim.go
new file mode 100644
index 000000000..ef4dc130d
--- /dev/null
+++ b/plugin/action/transform/stdlib/trim.go
@@ -0,0 +1,70 @@
+package stdlib
+
+import (
+	"strings"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+)
+
+// the trim family strips characters from the ends of a string:
+//
+//	trim(.message, " ")         -> both ends
+//	trim_left(.message, " ")    -> leading only
+//	trim_right(.message, "\n")  -> trailing only
+//
+// cutset is a *set of characters*, not a substring: trim_right(v, "ms") removes
+// every trailing "m" and "s", not the suffix "ms"; side is part of the function
+// name rather than a mode argument so that a typo is caught when the program is
+// compiled instead of on the first event that reaches it
+
+type trim struct{}
+
+func (trim) Name() string { return "trim" }
+
+func (trim) Params() []Parameter { return trimParams("both ends") }
+
+func (trim) Call(args map[string]core.Value) (core.Value, error) {
+	value, cutset := trimArgs(args)
+	return core.StringValue{V: strings.Trim(value, cutset)}, nil
+}
+
+type trimLeft struct{}
+
+func (trimLeft) Name() string { return "trim_left" }
+
+func (trimLeft) Params() []Parameter { return trimParams("the start") }
+
+func (trimLeft) Call(args map[string]core.Value) (core.Value, error) {
+	value, cutset := trimArgs(args)
+	return core.StringValue{V: strings.TrimLeft(value, cutset)}, nil
+}
+
+type trimRight struct{}
+
+func (trimRight) Name() string { return "trim_right" }
+
+func (trimRight) Params() []Parameter { return trimParams("the end") }
+
+func (trimRight) Call(args map[string]core.Value) (core.Value, error) {
+	value, cutset := trimArgs(args)
+	return core.StringValue{V: strings.TrimRight(value, cutset)}, nil
+}
+
+func trimParams(side string) []Parameter {
+	return []Parameter{
+		{
+			Name:          "value",
+			Description:   "The string to trim.",
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+		{
+			Name:          "cutset",
+			Description:   "Set of characters to remove from " + side + "; any character in the set is stripped.",
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+	}
+}
+
+func trimArgs(args map[string]core.Value) (string, string) {
+	return args["value"].(core.StringValue).V, args["cutset"].(core.StringValue).V
+}
diff --git a/plugin/action/transform/stdlib/trim_test.go b/plugin/action/transform/stdlib/trim_test.go
new file mode 100644
index 000000000..70cd67113
--- /dev/null
+++ b/plugin/action/transform/stdlib/trim_test.go
@@ -0,0 +1,54 @@
+package stdlib
+
+import (
+	"testing"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func trimCaller(t *testing.T, fn Function) func(value, cutset string) string {
+	t.Helper()
+
+	return func(value, cutset string) string {
+		got, err := callFn(fn, []core.Value{str(value), str(cutset)}, nil)
+		require.NoError(t, err)
+		return got.(core.StringValue).V
+	}
+}
+
+func TestTrim(t *testing.T) {
+	t.Parallel()
+	call := trimCaller(t, trim{})
+
+	assert.Equal(t, "data", call("  data  ", " "))
+	assert.Equal(t, "data", call("xxdataxx", "x"))
+	assert.Equal(t, "", call("aaa", "a"), "everything trimmed away")
+	assert.Equal(t, "", call("", " "), "empty input")
+	assert.Equal(t, "data", call("data", ""), "empty cutset changes nothing")
+}
+
+func TestTrimLeft(t *testing.T) {
+	t.Parallel()
+	call := trimCaller(t, trimLeft{})
+
+	assert.Equal(t, "data  ", call("  data  ", " "))
+	assert.Equal(t, "compaction", call("] compaction", "] "),
+		"cutset is a set of characters, so both ] and space are stripped")
+	assert.Equal(t, "data", call("data", "x"), "nothing to trim")
+}
+
+func TestTrimRight(t *testing.T) {
+	t.Parallel()
+	call := trimCaller(t, trimRight{})
+
+	// modify README: ${message|trim("right","\n")}
+	assert.Equal(t,
+		`{"service":"service-test-1","took":"200ms"}`,
+		call(`{"service":"service-test-1","took":"200ms"}`+"\n", "\n"))
+
+	assert.Equal(t, "  data", call("  data  ", " "))
+	assert.Equal(t, "took: 200", call("took: 200ms", "ms"),
+		"cutset is a set of characters, not a suffix")
+}
diff --git a/plugin/action/transform/stdlib/trim_to.go b/plugin/action/transform/stdlib/trim_to.go
new file mode 100644
index 000000000..4a8498e80
--- /dev/null
+++ b/plugin/action/transform/stdlib/trim_to.go
@@ -0,0 +1,91 @@
+package stdlib
+
+import (
+	"strings"
+
+	"github.com/ozontech/file.d/plugin/action/transform/core"
+)
+
+// the trim_to family cuts a string back to a delimiter, keeping the delimiter
+// itself:
+//
+//	trim_to(.message, "{")        -> both ends
+//	trim_to_left(.message, "{")   -> everything from the first "{"
+//	trim_to_right(.message, "}")  -> everything up to the last "}"
+//
+// cutset is a *substring*, not a set of characters - that is what separates this
+// family from trim; the left side searches the first occurrence and the right
+// side the last one, so trim_to_right(trim_to_left(v, "{"), "}") spans the
+// outermost pair rather than stopping inside a nested one, which is what the
+// modify plugin's trim_to filter does and what extracting a JSON object out of a
+// log line needs
+//
+// when the delimiter is not found the value is returned unchanged, the same
+// forgiving behavior as the substring family, so a line in an unexpected format
+// passes through instead of being emptied
+
+type trimTo struct{}
+
+func (trimTo) Name() string { return "trim_to" }
+
+func (trimTo) Params() []Parameter { return trimToParams("both ends") }
+
+func (trimTo) Call(args map[string]core.Value) (core.Value, error) {
+	value, cutset := trimArgs(args)
+	return core.StringValue{V: trimToRightOf(trimToLeftOf(value, cutset), cutset)}, nil
+}
+
+type trimToLeft struct{}
+
+func (trimToLeft) Name() string { return "trim_to_left" }
+
+func (trimToLeft) Params() []Parameter { return trimToParams("the start") }
+
+func (trimToLeft) Call(args map[string]core.Value) (core.Value, error) {
+	value, cutset := trimArgs(args)
+	return core.StringValue{V: trimToLeftOf(value, cutset)}, nil
+}
+
+type trimToRight struct{}
+
+func (trimToRight) Name() string { return "trim_to_right" }
+
+func (trimToRight) Params() []Parameter { return trimToParams("the end") }
+
+func (trimToRight) Call(args map[string]core.Value) (core.Value, error) {
+	value, cutset := trimArgs(args)
+	return core.StringValue{V: trimToRightOf(value, cutset)}, nil
+}
+
+// trimToLeftOf drops everything before the first occurrence of cutset
+func trimToLeftOf(value, cutset string) string {
+	if idx := strings.Index(value, cutset); idx != -1 {
+		return value[idx:]
+	}
+	return value
+}
+
+// trimToRightOf drops everything after the last occurrence of cutset
+// the delimiter is part of the result, hence idx+len(cutset) rather than idx+1:
+// a multi-byte delimiter must not be cut in half
+func trimToRightOf(value, cutset string) string {
+	if idx := strings.LastIndex(value, cutset); idx != -1 {
+		return value[:idx+len(cutset)]
+	}
+	return value
+}
+
+func trimToParams(side string) []Parameter {
+	return []Parameter{
+		{
+			Name:          "value",
+			Description:   "The string to trim.",
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+		{
+			Name:          "cutset",
+			Description:   "Substring to trim to from " + side + "; the delimiter itself is kept.",
+			AcceptedKinds: []core.ValueKind{core.KindString},
+		},
+	}
+}
diff --git a/plugin/action/transform/stdlib/trim_to_test.go b/plugin/action/transform/stdlib/trim_to_test.go
new file mode 100644
index 000000000..b0ce750b8
--- /dev/null
+++ b/plugin/action/transform/stdlib/trim_to_test.go
@@ -0,0 +1,68 @@
+package stdlib
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestTrimTo(t *testing.T) {
+	t.Parallel()
+	call := trimCaller(t, trimTo{})
+
+	assert.Equal(t, "[data]", call("noise [data] noise", "[data]"))
+	assert.Equal(t, "|a|b|", call("noise |a|b| noise", "|"),
+		"the left side takes the first occurrence and the right side the last one")
+	assert.Equal(t, "END message END", call("leading END message END trailing", "END"),
+		"a multi-byte delimiter spans the outermost pair")
+	assert.Equal(t, "unchanged", call("unchanged", "@"), "delimiter not found")
+	assert.Equal(t, "", call("", "@"), "empty input")
+	assert.Equal(t, "data", call("data", ""), "empty cutset changes nothing")
+}
+
+func TestTrimToLeft(t *testing.T) {
+	t.Parallel()
+	call := trimCaller(t, trimToLeft{})
+
+	assert.Equal(t, "{a} tail", call("head {a} tail", "{"), "the delimiter is kept")
+	assert.Equal(t, "-> b -> c", call("a -> b -> c", "->"),
+		"a multi-byte delimiter is matched as a substring, not as a set of characters")
+	assert.Equal(t, "unchanged", call("unchanged", "{"), "delimiter not found")
+	assert.Equal(t, "data", call("data", ""), "empty cutset changes nothing")
+}
+
+func TestTrimToRight(t *testing.T) {
+	t.Parallel()
+	call := trimCaller(t, trimToRight{})
+
+	assert.Equal(t, "head {a}", call("head {a} tail", "}"), "the delimiter is kept")
+	assert.Equal(t, "a -> b ->", call("a -> b -> c", "->"),
+		"the last occurrence wins and the whole delimiter survives")
+	assert.Equal(t, "ключ=значение", call("ключ=значение и хвост", "значение"),
+		"a multi-byte delimiter is never cut in half")
+	assert.Equal(t, "hello界", call("hello界 trailing", "界"), "a unicode delimiter is kept whole")
+	assert.Equal(t, "unchanged", call("unchanged", "}"), "delimiter not found")
+	assert.Equal(t, "data", call("data", ""), "empty cutset changes nothing")
+	assert.Equal(t, "", call("", ""), "empty input and empty cutset")
+}
+
+// the modify plugin's README example, which is the reason this family exists:
+// `${message|trim_to("left","{")|trim_to("right","}")}`
+func TestTrimToExtractsJSONObject(t *testing.T) {
+	t.Parallel()
+
+	left := trimCaller(t, trimToLeft{})
+	right := trimCaller(t, trimToRight{})
+
+	const line = `some data {"service":"service-test-1","took":"200ms"} some data`
+
+	assert.Equal(t,
+		`{"service":"service-test-1","took":"200ms"}`,
+		right(left(line, "{"), "}"))
+
+	// the nested case is what the substring family cannot do: between() stops at
+	// the first closing brace, trim_to spans the outermost pair
+	assert.Equal(t,
+		`{"a":{"b":1}}`,
+		right(left(`some data {"a":{"b":1}} some data`, "{"), "}"))
+}
diff --git a/plugin/action/transform/transform.go b/plugin/action/transform/transform.go
index dc2439d82..7c95ef6e6 100644
--- a/plugin/action/transform/transform.go
+++ b/plugin/action/transform/transform.go
@@ -37,7 +37,7 @@ pipelines:
     - type: transform
       source: |
         # parse lines like "INFO 2025-05-25 11:11:11,222 [shard 1] compaction - done"
-        m = capture(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
+        m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<time>\S+ \S+)\s+\[(?P<shard>[^\]]+)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.+)$')
         if m != null {
           .level = m.level
           .time = m.time
diff --git a/plugin/action/transform/transform_test.go b/plugin/action/transform/transform_test.go
index 030991b08..0f2f36dff 100644
--- a/plugin/action/transform/transform_test.go
+++ b/plugin/action/transform/transform_test.go
@@ -367,9 +367,9 @@ func TestLanguage(t *testing.T) {
 			},
 		},
 		{
-			name: "func_capture",
+			name: "func_parse_regex",
 			source: `
-			m = capture(.log, r'^(?P<level>\S+)\s+(?P<date>\d{4}-\d{2}-\d{2})\s+(?P<time>[\d:,]+)\s+\[(?P<shard>[^\]]*)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.*)$')
+			m = parse_regex(.log, r'^(?P<level>\S+)\s+(?P<date>\d{4}-\d{2}-\d{2})\s+(?P<time>[\d:,]+)\s+\[(?P<shard>[^\]]*)\]\s+(?P<operation>\S+)\s+-\s+(?P<message>.*)$')
 			if m != null {
 				.level = m.level
 				.date = m.date
@@ -402,9 +402,9 @@ func TestLanguage(t *testing.T) {
 			},
 		},
 		{
-			name: "func_string_template",
+			name: "func_to_string_template",
 			source: `
-			.note = "code is " + string(.code) + ", ok is " + string(.ok) + ", missing is '" + string(.nope) + "'"
+			.note = "code is " + to_string(.code) + ", ok is " + to_string(.ok) + ", missing is '" + to_string(.nope) + "'"
 		`,
 			events: []eventCase{
 				{