Splitting a field that looks like an array

[cdy5159 (David Yates)]

Found the problem, too many square brackets under add_field.

"[auditd][log][msg]" should be "[audit.log][msg]"
"[auditd][log][auditid]" should be "[auditd.log][auditid]"
"[auditd][log][auditmesg]" should be '"[auditd.log][auditmesg]"