Field Extraction with Multiline and Single line mixed

[rangarbus]

Hi Team:

Here on the Extraction for Event 2, the MESSAGE field is extracted as empty as its not multiline.
How should i extract MESSAGE for both multiline and single line.?

Query:

index=abcd sourcetype=fallback 
| rex field=_raw "^(?P<DATETIME>[^,]+),\d+\s+\[(?P<DAEMON>[^\]]+)\]\s+(?P<SEV>[^ ]+)\s+(?P<CLASS>[^ ]+)\s+\-\s+(?P<MESSAGE>(.*[\r\n]+)*)"
| table DATETIME, DAEMON, SEV, CLASS, MESSAGE

Event 1:

2020-12-07 17:43:02,075 [ABCD_Daemon1] WARN ABCD_CLASS1 - Failed to process
java.lang.InterruptedException
at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.reportInterruptAfterWait(AbstractQueuedSynchronizer.java:2014)
at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2048)
at java.util.concurrent.ArrayBlockingQueue.take(ArrayBlockingQueue.java:403)
at db.$EmailNotifierDaemon.run(asdasd.java:1133)

Extracted as:

DATETIME : 2020-12-07 17:43:02
DAEMON: ABCD_Daemon1
SEV: WARN
CLASS: ABCD_CLASS1
MESSAGE: Failed to process
java.lang.InterruptedException
at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.reportInterruptAfterWait(AbstractQueuedSynchronizer.java:2014)
at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2048)
at java.util.concurrent.ArrayBlockingQueue.take(ArrayBlockingQueue.java:403)
at db.$EmailNotifierDaemon.run(asdasd.java:1133)

Event 2:

2020-12-07 16:12:14,273 [ABCD_Daemon2] INFO ABCD_CLASS2 - Got notification for external configuration change, cleaning caches.

Extracted as:

DATETIME : 2020-12-07 16:12:14
DAEMON: ABCD_Daemon2
SEV: INFO
CLASS: ABCD_CLASS2
MESSAGE:

Thank you

[renjith_nair · Accepted solution]

Try adding the new line as not mandatory

change to

(?P<MESSAGE>(.*[\r\n]?+)*)