How to extract string in a field that spans multiple lines?

[jedatt01]

I'm trying to extract a string in a field that spans multiple lines. See example below.

03/09/2014 07:10:38 AM - Process(****.****) User(***) Program(*****)
                    Host(*****)
AMQ****: The data received from host '******* (*******)' is not
valid.
EXPLANATION:
An error has been detected, and the WebSphere MQ error recording routine has
been called. The failing process is process *****.
ACTION:
Use the standard facilities supplied with your system to record the problem
identifier and to save any generated output files. Use either the WMQ Support
site: http://www.ibm.com/software/integration/wmq/support/, or IBM Support
Assistant (ISA): http://www.ibm.com/software/support/isa/, to see whether a
solution is already available.  If you are unable to find a match, contact your
IBM support center.  Do not discard these files until the problem has been
resolved.
----- amqxfdcx.c : 829 --------------------------------------------------------

The part i'm trying to extract is below:
The data received from host '******* (*******)' is not
valid.

[jedatt01]

I also want to extract a field that will encapsulate the follow as well.

EXPLANATION:
An error has been detected, and the WebSphere MQ error recording routine has
been called. The failing process is process ****.

[somesoni2 · Accepted solution]

Try this

your base search | rex "(?m).*?: (?P<1ErrorMessage>[^\.]*)"

Updated:

your base search |rex "(?m).*?: (?P<ErrorMessage>(.*[\r\n]+)*)EXPLANATION:([\r\n]+)(?P<Explanation>(.*[\r\n]+)*)ACTION:"

[jedatt01]

works great!

[somesoni2]

Try the updated regex.

[jedatt01]

Getting closer, only problem is some of my events have an IP address in it so it stops after the first octet (ex. 192.

Is there a way to make it stop before it sees the string EXPLANATION:?