How to extract text from raw data using rex?

[9jamie]

I'm new to regex and having trouble extracting some text. My raw data is in the following format:

ID=[12839829389-8b7e89opf][2839128391DJ33838PR]

I need to extract the text between the first two brackets,12839829389-8b7e89opf, into a new field. 

So far what I have does not work: | rex field=_raw "ID=[(?<id>.*)]"

If anyone could help it would be greatly appreciated.

[ITWhisperer · Accepted solution]

Square brackets are special characters in regex so need to be escaped with backslashes

| rex field=_raw "ID=\[(?<id>.*)\]"

[9jamie]

this returns everything after ID up until the final closing bracket. so i added the brackets containing the second part of the id as well. final solution:

rex field=_raw "ID=\[(?<id>.*\]\[.*\]"

thanks for the help