problem extracting empty values

[Be_JAR]

Hi all,

I am ingesting data and I have  a problem :

event example:
field1 = /var/log/asas/log1.log
field2 = /var/log/as/as/log2.log
field3 = /var/log/as/as/log3.log

in the sourcetype (props.conf) I do it like this:
^.*field1 \=\s*(?<log1>.*?)\s*\n
^.*field2 \=\s*(?<log2>.*?)\s*\n
^.*field3 \=\s*(?<log3>.*?)\s*\n

The problem is when the value of some field appears empty. In that case capture the following line. like this:

source:
field1 = /var/log/as/as/log1.log
field2 = 
field3 = /var/log/log/as/log3.log

result:
log2= field3 = /var/log/logs/log3.log

I'm sure there is a way to fix it and make the field appear empty, but I can't find it. Does anyone know how to do it?

BR

JAR

[ITWhisperer · Accepted solution]

Try something like this

(?m)^.*field1 \=\s*(?<log1>\S*?)\s*\n
(?m)^.*field2 \=\s*(?<log2>\S*?)\s*\n
(?m)^.*field3 \=\s*(?<log3>\S*?)\s*\n