title: logstash _grokparsefailure issues
body: <p>I'm having issues with grok parsing.
  In ElasticSearch/Kibana the lines I match come up with the tag _grokparsefailure.</p>
  
  <p>Here is my logstash config :</p>
  
  <pre><code>input { 
      file { 
       type =&gt; logfile 
       path =&gt; ["/var/log/mylog.log"] 
      } 
    } 
  filter { 
      if [type] == "logfile" 
      { 
        mutate {
        gsub =&gt; ["message","\"","'"]
        }  
  
      grok 
          { match =&gt; { "message" =&gt; "L %{DATE} - %{TIME}: " } } 
      } 
  } 
  
  output { 
     elasticsearch { host =&gt; localhost port =&gt; 9300 } 
  }
  </code></pre>
  
  <p>lines/patterns I'm trying to match :
  L 08/02/2014 - 22:55:49: Log file closed : " finished "</p>
  
  <p>I tried the debugger on <a href="http://grokdebug.herokuapp.com/">http://grokdebug.herokuapp.com/</a> and it works fine, my pattern matches correctly.</p>
  
  <p>Lines I want to parse might contain double quotes, and I've read there can be issues with the way grok handles and escapes them. 
  So I tried to mutate to replace " with ' to avoid issues but no luck.</p>
  
  <p>Any ideas ?
  How can I debug this ?</p>
  
  <p>Thanks</p>