I've read the threads on escaping the parens and the such. But I'm trying to do the "]". I thought I would be able to just swap the ")" for "]" in the rex command but it doesn't work. Line: ....[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4] So I've tried the following to extract field2 as value2. The closest one I get is the first and second one. I get the field to extract, but it doesn't cut off on the "]" after it (so the values look like: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]) rex field=_raw "myfield2: (?<myextractvalue2>.*)\\]" rex field=_raw "myfield2: (?<myextractvalue2>.*)\]" rex field=_raw "myfield2: (?<myextractvalue2>\w)\\]" Any help would be greatly appreciated. Thanks. ... View more