How to escape the end bracket using rex?

[rbdev]

I've read the threads on escaping the parens and the such. But I'm trying to do the "]". I thought I would be able to just swap the ")" for "]" in the rex command but it doesn't work.

Line: ....[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]

So I've tried the following to extract field2 as value2. The closest one I get is the first and second one. I get the field to extract, but it doesn't cut off on the "]" after it (so the values look like: myvalue2][myfield3:myvalue3] [myfield4:myvalue4])

rex field=_raw "myfield2: (?<myextractvalue2>.*)\\]"

rex field=_raw "myfield2: (?<myextractvalue2>.*)\]"

rex field=_raw "myfield2: (?<myextractvalue2>\w)\\]"

Any help would be greatly appreciated. Thanks.

[poete]

Hello,

this should do :

| makeresults 
| eval someField="[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]"
| rex field=someField "myfield2: (?<myextractvalue2>[A-Za-z0-9]+)" 
| rex field=someField "myfield3:(?<myextractvalue3>[A-Za-z0-9]+)"
| rex field=someField "myfield4:(?<myextractvalue4>[A-Za-z0-9]+)"

[cpetterborg · Accepted solution]

Try:

rex field=_raw "myfield2:\s*(?<myextractvalue2>[^\]]*)"

or

rex field=_raw "myfield2:\s*(?<myextractvalue2>.*?)\]"

[rbdev]

EXCELLENT!! Thank you! The second actually worked better for me. The first one sometimes cut the value for some reason. But the second one perfect!