modify: check for non-existence with regex

[ghost]

Currently it is not possible to check both for non-existence and a value with just one rule, e.g.:

        "if": {
            "classification.identifier": "^(|botnet)$"
         }

Events with a non-existent classification.identifier do not match this value, as a non-empty value in the rule is assumed as "field must exist".

[ghost]

Workaround: Create two rules:

        "if": {
            "classification.identifier": ""
         }

and:

        "if": {
            "classification.identifier": "^botnet$"
         }