So after I understood that recursive regex isn't supported probably I tried a different regex with max 2 levels of nesting:
\[(?:[^\]\[]+|\[(?:[^\]\[]+|\[[^\]\[]*\])*\])*\]
It seems to work when testing:
Logstash also loads successfully, but still splits the fields in the wrong way...
What am I missing? perhaps need a different filter for this one? or even ruby code?
Thanks for the help.