field extraction after brackets value

[indeed_2000]

hi i have log file like below
need to extact the section after first "]" to "[" or "." or ":"

2020-04-24 23:59:59,511 INFO  ABCD.InIT-Service-1234567 [SrvListener] Receive Message[123456789ABCD123E123456789*] from [Service.APP]
2020-04-24 23:59:57,055 INFO  ABCD.InIT-Service-1234567_EFGH.InIT-AppService-5764693 [AbcEndpointManager] Send Message [123456789ABCD123456789123456789*] to A[000] B[0000]
2020-04-24 23:59:59,081 INFO  ABCD.InIT-Host-1234567_EFGH.InIT-Service-1234567 [TopologyProcessorService] Message Processed: A[000] B[0000]
2020-04-24 23:29:59,844 INFO  ABCD.InIT-Service-1234567 [NetworkProcessor] NetworkProcessor Accomplished: A[000] B[0000]
2020-04-24 23:29:59,851 INFO  NAME-1234567 [ExecuteService] CustomeService_clusterCustomeCommand chain was done. Define Parameters[input0='00000',input1='000000']

expected value:

• Receive Message
• Send Message
• Message Processed
• NetworkProcessor Accomplished
• CustomeService_clusterCustomeCommand chain was done

Thanks

[manjunathmeti · Accepted solution]

Use rex:

index = INDEX | rex "\]\s(?<message>[\w\s]+)"

Sample query:

| makeresults 
| eval _raw=" _raw
2020-04-24 23:59:59,511 INFO  ABCD.InIT-Service-1234567 [SrvListener] Receive Message[123456789ABCD123E123456789*] from [Service.APP]
2020-04-24 23:59:57,055 INFO  ABCD.InIT-Service-1234567_EFGH.InIT-AppService-5764693 [AbcEndpointManager] Send Message [123456789ABCD123456789123456789*] to A[000] B[0000]
2020-04-24 23:59:59,081 INFO  ABCD.InIT-Host-1234567_EFGH.InIT-Service-1234567 [TopologyProcessorService] Message Processed: A[000] B[0000]
2020-04-24 23:29:59,844 INFO  ABCD.InIT-Service-1234567 [NetworkProcessor] NetworkProcessor Accomplished: A[000] B[0000]
2020-04-24 23:29:59,851 INFO  NAME-1234567 [ExecuteService] CustomeService_clusterCustomeCommand chain was done. Define Parameters[input0='00000',input1='000000']" 
| multikv forceheader=1 
| rex "\]\s(?<message>[\w\s]+)" 
| fields _raw, message

[indeed_2000]

work like charm, thank you 😉