title: Grok failing on brackets
body: <p>I'm getting a consistent grok failure on brackets. I've escaped the bracket with a '\'.  I've also tried to fool it with wildcards.  Grok debugger parses correctly, but fails to parse in production. I have two other entries that are exhibiting the same behavior while other patterns without brackets are parsing.</p>
  
  <p>The '%{WORD:type}[%{INT:pid}]' is the issue.</p>
  
  <pre><code>#Jan 15 13:35:44 firewall sshd[1468]: Accepted publickey for john from 192.168.1.16 port 62529 ssh2: .....
  AUTHLOG1 (%{SYSLOGTIMESTAMP:timestamp} %{WORD:src_host} %{WORD:type}\[%{INT:pid}\]: Accepted publickey for %{USERNAME:user} from %{IP:src_ip} port %{INT:port} %{WORD:protocol}*)
  
  #Jan 15 13:35:44 firewall systemd-logind[1221]: New session 481 of user john.
  AUTHLOG4 (%{SYSLOGTIMESTAMP:timestamp} %{WORD:src_host} (?&lt;type&gt;[a-z-]+)\[%{INT:pid}\]: Removed session %{INT:session}.)
  
  AUTHLOG (?:%{AUTHLOG1}|%{AUTHLOG2}|%{AUTHLOG3}|%{AUTHLOG4}|%{AUTHLOG5}|%{AUTHLOG6})
  
   if [type] == "authlog" {
          grok {
                  match =&gt; { "message" =&gt; "%{AUTHLOG}"}
                  patterns_dir =&gt; ["/etc/logstash/grok"]
          }
    }
  </code></pre>