Hi @pcollardez,
Thank you for this report. This is indeed a bug with the parser. I've written a public issue for it over on Github: Syslog reader/processor does not handle escaped brackets in structured data fields · Issue #40445 · elastic/beats · GitHub