Why can't I extract the information in the log as a label

I want to capture the log level as a label in Kubernetes’ events log

$ kubectl get events
LAST SEEN   TYPE      REASON              OBJECT                                            MESSAGE
16m         Normal    Scheduled           pod/aaaaaaaaaaaaaa-7c949b9568-sl4jf               Successfully assigned default/aaaaaaaaaaaaaa-7c949b9568-sl4jf to tech-lab-08
15m         Normal    Pulling             pod/aaaaaaaaaaaaaa-7c949b9568-sl4jf               Pulling image "ghcr.io/moelove/non-exist"
15m         Warning   Failed              pod/aaaaaaaaaaaaaa-7c949b9568-sl4jf               Failed to pull image "ghcr.io/moelove/non-exist": failed to pull and unpack image "ghcr.io/moelove/non-exist:latest": failed to resolve reference "ghcr.io/moelove/non-exist:latest": failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Amoelove%2Fnon-exist%3Apull&service=ghcr.io: 403 Forbidden

This is my alloy configuration, and I wanted to create a new tag ‘log_level’ with a value derived from type=Warning in the capture log, but it didn’t work as expected

    content: |-
      loki.source.kubernetes_events "cluster_events" {
        job_name   = "integrations/kubernetes/eventhandler"
        log_format = "logfmt"
        forward_to = [
        loki.process.cluster_events.receiver,
          ] 
      }
      loki.process "cluster_events" {
        forward_to = [loki.write.loki.receiver]
        
        stage.drop {
          expression  = "type=Normal"
          //longer_than = "1KB"
      }
      
        stage.static_labels {
          values = {
            cluster = "inboc-test",
          }
        }
      
        stage.labels {
          values = {
            kubernetes_cluster_events = "job",
          }
        }
      
        stage.regex {
          expression = `(?P<level>(?i)\b(type=Warning|type=Normal)\b)`
      }
        
        stage.labels {
          values = { "log_level" = "level" }
        }
      }

The regex seems ok to me, when you say it’s not working as expected what do you mean by that? Is it not picking it up, or picking up the wrong value?

I am not sure if this is intended, you are picking up type=Warning with this, and your label would read log_level=type=Warning. Perhaps this might be better? type=(?P<level>(?i)\b(Warning|Normal)\b)