If the end goal is to count all the events then it shall be done on a field which occurs in all the events, something like field1 IP to get all the events.
Ideal approach per my opinion shall be, filter events of "deny-service reports" and extract the field1 and field2. And filter events on "service-http reports" and extract all 5 fields. However if all need to be extracted in one extraction, below is what can be tried which shall assign "some value" when that field is absent from the event, and the required value when field is present in the event.
your query to get events
| rex "for host (?<ipAddress>(\d{1,3}\.)+\d{1,3}).+GET\s*(?<uri>[^,]+),\s*(deny-service reports:|service-http reports:)\s*(?<keycode>[^\s]+)(unable to contact|\s)*(?<backendHost>[^\s]+)\s*\(*(?<error>[^\)]+)*"
| table ipAdderss, uri, keycode, backendHost, error
Extraction is here
... View more