title: grok filter (regex) to extract string within square brackets
body: <p>My application log entries are given below:</p>
  
  <pre><code>2015-06-24 14:03:16.7288  Sent request message [649b85fa-bfa0-4cb4-8c38-1aeacd1cbf74] &lt;Request&gt;sometext&lt;/Request&gt;
  
  2015-06-24 14:38:05.2460  Received response message [649b85fa-bfa0-4cb4-8c38-1aeacd1cbf74] &lt;Response&gt;sometext&lt;/Response&gt;
  </code></pre>
  
  <p>I am using logstash grok filter to extract the xml content and the client token with the square bracket.</p>
  
  <pre><code>grok {  
      match =&gt; ["message", "(?&lt;content&gt;(&lt;Request(.)*?&lt;/Request&gt;))"]   
      match =&gt; ["message", "(?&lt;clienttoken&gt;(Sent request message \[(.)*?\]))"]
      add_tag =&gt; "Request"
      break_on_match =&gt; false
      tag_on_failure =&gt; [ ]
  }
  
  grok {  
      match =&gt; ["message", "(?&lt;content&gt;(&lt;Response(.)*?&lt;/Response&gt;))"] 
      match =&gt; ["message", "(?&lt;clienttoken&gt;(Received response message \[(.)*?\]))"]
      add_tag =&gt; "Response"
      break_on_match =&gt; false
      tag_on_failure =&gt; [ ]
  }
  </code></pre>
  
  <p>Now the result looks like below</p>
  
  <p>For the first log line: </p>
  
  <pre><code>Content =  &lt;Request&gt;sometext&lt;/Request&gt;
  clienttoken = Sent request message [649b85fa-bfa0-4cb4-8c38-1aeacd1cbf74]
  </code></pre>
  
  <p>For the second log line:</p>
  
  <pre><code>Content = &lt;Response&gt;sometext&lt;/Response&gt;
  clienttoken = Received response message [649b85fa-bfa0-4cb4-8c38-1aeacd1cbf74]
  </code></pre>
  
  <p>But I want the result to be like this:</p>
  
  <pre><code>Content = &lt;Request&gt;sometext&lt;/Request&gt;
  clienttoken = 649b85fa-bfa0-4cb4-8c38-1aeacd1cbf74
  </code></pre>
  
  <p>Please let me know how to extract only the strings within the square bracket without all the matching string in the pattern.</p>