Why does Regex Painless Script only extract data from certain docs even when in the field exist in each doc?

[Daniel_Gonzalez1 (Daniel Gonzalez)]

Hello Everyone!

I made a regex painless script to extract some values from the message field, but at the moment to extract the values, the script only extract de values from a certain docs even when the value appears in all the docs, the log message is the same for every doc

This is an example:

This is my Painless Script:

if (doc['message.keyword'].size() == 0) return '';
Matcher m = /MXP1\sRACF\s(\w+)\s/.matcher(doc['message.keyword'].value);
if ( m.find() ) {
   return m.group(1)
} else {
   return "no match"
}

It suppose the regex match in every doc! I don't know why is not recognizing the regex

[Marius_Dragomir]

It feels like an issue with the regex filter. Can you try and use it in a regex tester on the fields that it doesn't work and you think it should?