如何在regex语句中找到[**],以便我可以为AWS CloudWatch代理使用多行\启动\模式

我有一个像这样的日志流:

[**] [1:10000001:1] ICMP test [**]
[Priority: 0] 
12/12-05:35:39.933931 172.31.12.xxx -> 172.31.2.xxx
ICMP TTL:64 TOS:0x0 ID:375 IpLen:20 DgmLen:84 DF
Type:8  Code:0  ID:14832   Seq:3927  ECHO

[**] [1:10000001:1] ICMP test [**]
[Priority: 0] 
12/12-05:35:40.933854 172.31.12.106 -> 172.31.2.207
ICMP TTL:64 TOS:0x0 ID:417 IpLen:20 DgmLen:84 DF
Type:8  Code:0  ID:14832   Seq:3928  ECHO

我想使用CloudWatch代理从多行事件创建单个事件。

每个文档:

multi_line_start_pattern – Specifies the pattern for identifying the start of a log message. A log message is made of a line that matches the pattern and any following lines that don't match the pattern.
If you omit this field, multi-line mode is disabled, and any line that begins with a non-whitespace character closes the previous log message and starts a new log message.

如何创建一个regex来查找[**]是否存在。例如。

"multi_line_start_pattern": "\\[\\*\\*\\]\\"

对于模式:

[**] ANYTHING [**]

从我收集到的信息来看,找到[**]的存在就足以找到多行事件的开始。

那么要找到的regex模式是什么呢[ ]或者更好[ ]有什么事吗?我不认识雷杰克斯

谢谢