filter {
  dissect {
    mapping => {
      # (stuff1)[stuff2][172.17.10.31]message
      "message" => "\(%{stuff1}\)\[%{stuff2}\]\[%{ip}\]%{message}"
    }
  }
  dissect {
    mapping => {
      # (stuff1)[172.17.10.31]message
      "message" => "\(%{stuff1}\)\[%{ip}\]%{message}"
    }
  }
  dissect {
    mapping => {
      # (stuff1)message
      "message" => "\(%{stuff1}\)%{message}"
    }
  }
}