How to search for a string that begins with a square bracket ]?

[spadler]

I have a field value like this that I want to exclude.

[22minfo[3: host.console[0]

The searches I can think of either don't do anything or return an error. Note, I am trying to speed up a search so I do not want to use regex. 

Searches I tried:

message != [*
message != "["*
message != "[*"
message != '[*'
message != '['*

[richgalloway]

I'm wondering if there's a "hidden" ESC character before the [ that keeps your searches from matching.  Try this regex command to see if it helps.  I understand you prefer to not use regex, but if nothing else works then why not?

| regex message!="^\x1b\["

[spadler]

It's my understanding that regex doesn't speed up searches. Is that right? Because the values that start with [ are not relevant to me and take up over half the results. They are being filtered out by other regex expressions, so I don't mind them being in the results except for the impact they have on speed. 

[richgalloway]

It understood the OP as looking for ways to filter out certain events, but now you say they're already filtered.  So is the goal a "faster" way to do the filtering?  If so, have you looked at the Job Inspector to see how much time is spent doing regex?  It's probably not much compared to other parts of the job.

If there indeed is an ESC character before the [ then the only non-regex way to find it will be message != "*[*", but that will find a lot of false positives so is not useful.

[spadler]

Yes I think you're right. Using regex seems to be about as fast as doing something similar with the 'search' command or the 'where' command. I was confused about what order things should be done in for optimization. I also found the info on Parallel processing on this page useful. Thanks for your input.