How to extract fields with empty values at index time?

[pavan_bhumanapa]

In our logs, we have the below two lines where we need to extract both empty & values for Dms_Code. Currently we are getting only values, but not empty, due to this other values are not getting populated in the UI.

Regex :

EXTRACT-Server_Name=\[(?<TimeDate>[^]]+)\]\s\[(?P<Server_Name>[^]]+)\]\s\[(?P<severity>[^]]+)\]\s\[\w+\-(?P<Dms_Code>[^]]+)\]\s\[(?P<Incident>[^]]+)\]\s


[2014-07-16T22:38:17.251+08:00] [apj_corp1_osb_dit_admin] [NOTIFICATION] [] [oracle.security.audit.logger]

[2014-07-16T22:37:47.379+08:00] [apj_corp1_osb_dit_admin] [WARNING] [DMS-50966] [oracle.dms.collector]

[somesoni2]

Try this

EXTRACT-Server_Name = \[(?<TimeDate>[^\]]+)\]\s\[(?P<Server_Name>[^\]]+)\]\s\[(?P<severity>[^\]]+)\]\s\[(\w+-)*(?P<Dms_Code>\d*)]\s\[(?<Incident>[^\]]+)\]

[strive]

I think it is because in your regex you have used w+ for Dms_Code, it is not getting empty values. Modify your regex to accept empty values also.