Correct! Try
dissect { mapping => { "message" => '%{dateTime} %{+dateTime} %{} Host:"%{host}" Zone:"%{zone}" "%{adapter}" "%{process}" %{process_id} %{header}
%{?content}' } }
That is, use single quotes around the pattern so that you do not have to escape the double quotes, and use a literal newline in the pattern string.