# (stuff1)[stuff2][172.17.10.31]message
filter {
  dissect {
    mapping => {
      "message" => "\(%{stuff1}\)%{message}"
    }
  }
  if [message] =~ /^\[\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/ {
    # We are use case three
    dissect {
      mapping => {
        # (stuff1)[172.17.10.31]message
        "message" => "\[%{ip}\]%{message}"
      }
    }
  } else {
    dissect {
      mapping => {
        # message
        "message" => "%{message}"
      }
    }
  }
}