Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)? ... View more

  [{(, ](?<Dimensions>(\[[^\]]+\]\.)+)   gives 755 steps for the data provided in your regex101.com my solution at  https://regex101.com/r/HEdUhy/2  with your exact prefix. If you remove prefix it turns to be 357 steps for your given data.  (?<Dimensions>(\[[^\]]+\]\.)+) solution at https://regex101.com/r/HEdUhy/3  ... View more