title: Logstash Grok pattern with double quotes
body: <p>I am parsing proxy logs with Logstash and its Grok filter. The logs contain quoted strings :</p>
  
  <pre><code>1438120705 [.....] "SEF-EDP8" - "C"
  "/GPM/1023/5745-7/456V/"
  </code></pre>
  
  <p>With the <a href="http://grokdebug.herokuapp.com/" rel="noreferrer">Grok Debugger</a> the following pattern works like a charm :</p>
  
  <pre><code>%{NUMBER:ts} [......] (-|"%{USERNAME:token1}") (-|%{DATA:token2}) (-|"%{WORD:token3}") (-|"%{DATA:token4}")
  </code></pre>
  
  <p>This does not work with Logstash's Grok because of the double quotes in the grok pattern. Logstash error log :</p>
  
  <pre><code>Error: Expected one of #, {, } at line 9, column 204 (byte 374) after
  filter {
      grok {
          match =&gt; { "message" =&gt; "%{NUMBER:ts} [......] ("
  </code></pre>
  
  <p>So I use the QuotedString grok pattern instead :</p>
  
  <pre><code>%{NUMBER:ts} [......] (-|%{QS:token1}) (-|%{DATA:token2}) (-|%{QS:token3}) (-|%{QS:token4})
  </code></pre>
  
  <p>This works with the <a href="http://grokdebug.herokuapp.com/" rel="noreferrer">Grok Debugger</a> as well, but quotes are extracted with quoted strings. It <strong>doesn't work with Logstash either</strong> :</p>
  
  <pre><code>token1 : ""SEF-EDP8"" token2 : null token3 : ""C"" token4 :
  ""/GPM/1023/5745-7/456V/""
  </code></pre>
  
  <p>How can I make it work with <strong>Logstash</strong>?
  How can I <strong>remove</strong> these unwanted extra <strong>double quotes</strong>?</p>