_grokparsefailure as soon as space in field

Elastic Stack Logstash
2

The first pattern does not work because inside square brackets period does not mean "any character", it means a literal period. The other two work for me. For example,

input { generator { count => 1 lines => [ '"foo bar"' ] } }
filter {
    grok { match => { "message" => "\"(?<ip2>[\S\s]+)\"" } }
}
output { stdout { codec => rubydebug { metadata => false } } }

produces

       "ip2" => "foo bar",
   "message" => "\"foo bar\"",