The +E mode escapes characters '"', '\' and ']' with '\' as prefix. It mostly makes sense to use it in the RFC5424 structured-data log formats. Example: log-format-sd %{+Q,+E}o\ [exampleSDID@1234\ header=%[capture.req.hdr(0)]]