1. A method, comprising: receiving a structured application layer message at a network device; identifying, in message classification requirements at the network device, a reference to: a classification portion of the structured application layer message that is used to classify the structured application layer message; and an operation portion of the structured application layer message that is used to perform operations on a classified structured application layer message; determining one or more expressions, based on the reference to the classification portion, that indicate a portion of the structured application layer message used to classify the structured application layer message; determining one or more location identifiers, based on the reference to the operation portion, that indicate a portion of the structured application layer message used to perform the operations; extracting, based on the one or more expressions, an extracted portion of message information for classifying the structured application layer message; and classifying, using the extracted portion of the message information, the structured application layer message according to the message classification requirements; performing, at least in part by accessing information indicated by the one or more location identifiers, at least one operation on the classified structured application layer message; wherein the method is performed by one or more processors.