Search-time? Index-time? Are all the events similar? Is that the whole event?
If you just want a search-time rex way with the example data being the whole event:
... | rex "\[(?P<ms>\d+)ms\]"
If it isn't the entire event, then use the field=yourfieldname option to the rex command.
