I think your regex for other_vals is off. If you are expecting it to match something like “optval2=aaa” then your pattern needs to include numbers and “=”. Currently you are only matching letters and space.
I was successfully able to make that work. And other_vals did include a leading space.
However, set_field does indeed trim white space.
Oh, right. Thank you @patrickmann. I edited the example to fix these. See any more errors?
Yes, it all works when I put it into a single pipeline rule. I wanted to split it in multiple rules because there more ways this other_vals can look.
So far I have only ugly ideas:
Match space or beginning in regex: regex("^(?:(?:^| )optkeyB=([a-zA-Z]+))?(?:(?:^| )optkeyC=([a-zA-Z]+))?(?:(?:^| )optkeyD=([a-zA-Z]+))?$", to_string($message.stash), but I find that mess of characters hard to read.
Re-add that space regex("^(?: optkeyB=([a-zA-Z]+))?(?: optkeyC=([a-zA-Z]+))?(?: optkeyD=([a-zA-Z]+))?$", concat(" ", to_string($message.stash)), but that feels dirty
Protect that space by prepending some “guard” or replacing - idea by @gsmith’s links, but that match group is optional. I don’t know how to prepend a character if it is string, but keep it null if it is null.