I have the below log line:
Slow GraphQL query [8447ms]
How can I grab only the value "8447"?
Search-time? Index-time? Are all the events similar? Is that the whole event?
If you just want a search-time rex way with the example data being the whole event:
... | rex "\[(?P<ms>\d+)ms\]"
If it isn't the entire event, then use the field=yourfieldname option to the rex command.
Please find the following image