How to filter out the event log based on the Message attribute which is having space

[nsudha1975]

Here is my event log sample below
[LOG LEVEL=INFO] [LOGGER=WIFI_ACCESS_INFO] [INTERFACE ID=WIFI_ACCESS] [STEP=START] [RUN_ID=20200426140325679] [Message=Call received for PID: 1234 ]

Actually i don't need this event, so I would like filter out this event based on the Message but it is not working as Message has phrase. Please let me know how to filter out this event. Thanks for your help in advance.

[PavelP]

Hello @nsudha1975,

there are several options, two of them are:

  | regex _raw!="\[Message=Call received for PID"

and

  NOT "Message=Call received for PID"

if you want to extract the field Message in full try this:

  | rex "\[Message=(?<Message>[^\]]+)\]"

Let me know how it went