The first pattern does not work because inside square brackets period does not mean "any character", it means a literal period. The other two work for me. For example,
input { generator { count => 1 lines => [ '"foo bar"' ] } }
filter {
grok { match => { "message" => "\"(?<ip2>[\S\s]+)\"" } }
}
output { stdout { codec => rubydebug { metadata => false } } }
produces
"ip2" => "foo bar",
"message" => "\"foo bar\"",