The Correlation Workflow

Before we dive into specific extractors, let me give you the mental model for correlation. Think of it as a three-step dance that happens between every pair of dependent requests. Once you internalize this pattern, you can correlate anything -- HTML forms, JSON APIs, XML SOAP responses, even binary protocols.

The Three-Step Correlation Pattern

Step 1: Identify -- Finding the Source Response

This is the detective work. You need to figure out which response contains the value you need. Open the View Results Tree listener, run your test once, and look at the Response Body tab for each request. Search for the token value that you see hardcoded in the next request. For example, if your POST /login sends csrf=abc123, search for "abc123" in the response body of the GET /login that came before it.

Step 2: Extract -- Choosing the Right Extractor

JMeter gives you several Post Processors for extraction. Choosing the right one depends on the response format. This is like choosing the right tool from your toolbox -- you would not use a hammer to turn a screw.

Step 3: Inject -- Using the Extracted Variable

Once you extract a value into a variable (say, csrf_token), you reference it anywhere in JMeter using the ${csrf_token} syntax. This works in request bodies, URLs, headers, parameters -- literally anywhere you can type text in JMeter. JMeter replaces ${csrf_token} with the actual extracted value at runtime.

# In URL path:
GET /api/users/${user_id}/profile

# In request body (form data):
username=${username}&password=${password}&_csrf=${csrf_token}

# In request body (JSON):
{"orderId": "${order_id}", "token": "${auth_token}"}

# In HTTP Header Manager:
Authorization: Bearer ${jwt_token}
X-CSRF-Token: ${csrf_token}

# In another extractor's regex (chaining):
Regular Expression: "userId":"${user_id}","orderStatus":"(.+?)"

# Even in filenames for CSV Data Set Config:
test-data/${env}_users.csv

Where to Place the Extractor in the Test Plan

This trips up a lot of beginners. Post Processors are children of the sampler (request) whose response you want to extract from. If you want to extract a token from the response of "GET /login", you right-click on "GET /login" and add the extractor as a child. NOT as a child of the next request. NOT as a sibling. As a CHILD of the source request.

Test Plan
└── Thread Group
    ├── GET /login                          <-- Source request
    │   └── Regular Expression Extractor    <-- CORRECT: child of source
    │       (extracts csrf_token)
    ├── POST /login                         <-- Uses ${csrf_token}
    │   └── JSON Extractor                  <-- Extracts auth_token from POST response
    │       (extracts auth_token)
    └── GET /api/dashboard                  <-- Uses ${auth_token}

# WRONG placement:
Test Plan
└── Thread Group
    ├── GET /login
    ├── Regular Expression Extractor        <-- WRONG: sibling, not child
    ├── POST /login
    └── GET /api/dashboard