How to edit my regex to extract this pattern from my sample data?

[koushiknandan]

I am trying to extract a pattern as below. Tried a few things, but all sorts of junk data is being picked up.

Event (Data)
2000-04-01T12:11:14,660 INFO [[abcdef4-abcdefghij].abcdEfghijklm.nopqrstu.21] [AbcDefghi] ABCD EFGH : ILIKEYO_KNOW | ABCDE FGHI : WAR_RIGG_IS_BAD | ABCDEF GH : XYZ1190560709120516-88328[ABCDEFG HIJKLM : 5.7_WOLFER]

Tried with the following

* | rex field=_raw "^(?:[^:\n]*:){5}\s+(?P[^\[]+)"

1. I am trying to extract the entire text (in bold). The above pattern gives me the text, but other fields are also getting matched. How can I strengthen the regex so that only this type of event gets analyzed?

2. Is it possible to use some of the text fields which would be unique (colored in blue), so that they can be used in a better way?

Thanks in Advance,
Koushik

[javiergn · Accepted solution]

One way of doing it could be using the following regex:

| rex field=_raw "(?msi)\|[\w\s]+:\s+(?<pattern>[\w\s\-]+)\[[^\]]+\]$"

That will create a new field called pattern with the text in bold you were referring too.
If you wanted to include some of the text fields in blue that you reckon will be static you could, but the regex above is already extremely fast (just 22 steps to match what you are looking for).

Keep in mind your text in bold has to be an alphanumeric character, space or hyphen in order to match this: [\w\s-]+
If that's not the case you will need to include any new possible character that might appear between the square brackets.