re = /\s*([\w ]+):\s*(\[((?>[^[\]]+|(?2))*)\])/
str = 'BotInfo[-]: Source IP:[10.1.1.100] Target Host:[CentOS70-1] Target OS:[CentOS 7.0] Description:[HTTP Connection Request] Details:[10.1.1.101 - - [28/May /2013:12:24:08 +0000] "GET /math/html.mli HTTP/1.0" 404 3567 "-" "-" ] Phase: [Access] Service:[WEB]
Target Os:[Centos]'
subst = 'Field: \\1 Value: \\3\\n'
result = str.gsub(re, subst)
# Print the result of the substitution
puts result
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Ruby, please visit: http://ruby-doc.org/core-2.2.0/Regexp.html