Looking at some of the other JSON answers, I tried setting KV_MODE=auto_escaped but that did not eliminate the issue in my testing.
So you'll need to set up field extractions as somesoni2 suggested.
Example (assuming data above is the exact event format):
You'll have to adjust the regex if there's more data following the action_params KV pair that has similar KV pairs to extract.
If you have the option to modify the log format of these messages, it seems like the best way would be to remove the quotes before the brackets. That turns the events into legal JSON, so they should be automatically extracted.