Ah, this DID work! There was a temporary problem with our data that caused an issue. Thank you!
| rex "hostname (?<hostname>[^\s]*)"
That didn't seem to work - no results were produced. The hostname string is within a field called "msg" if that matters (though I tried plugging that in and still can't get results).