I tried this scripted field but the format on some messages (space or no space between response code and "(" is different so this maybe isn't a good solution;
In the index pattern, scripted fields tab, I added this number type scripted field. It finds the "(" char and then gets substring starting 3 chars in front of that and up to that "(".
doc['Message.keyword'].value.substring(doc['Message.keyword'].value.indexOf("(")-3, doc['Message.keyword'].value.indexOf("("))
So it's really better to improve the ingest side to get the different parts of the message into separate fields.