title: grok - how do you find a quoted string
body: <p>I am trying to grab the output from an nginx log file and send it to logstash.</p>
  
  <pre><code>10.1.10.20 - bob [14/Feb/2014:18:57:05 +0000] “POST /main/foo.git/git-upload-pack HTTP/1.1” 200 3653189 “-” “git/1.8.3.4 (Apple Git–47)” 
  </code></pre>
  
  <p>Grock is able to find the first 3 words fine</p>
  
  <pre><code>10.1.10.20 - bob [14/Feb/2014:18:57:05 +0000]
  
  %{IPV4:user_ip} - %{USERNAME:user_name} \[%{HTTPDATE:time_local}\]
  </code></pre>
  
  <p>Grok is able to find the 3rd and 4th words fine</p>
  
  <pre><code>[14/Feb/2014:18:57:05 +0000] “POST /main/foo.git/git-upload-pack HTTP/1.1”
  
  \[%{HTTPDATE:time_local}\] %{QUOTEDSTRING:request}
  </code></pre>
  
  <p>However when I combine them, and try to find all 4, grok says there are no results (using <a href="http://grokdebug.herokuapp.com/" rel="nofollow">http://grokdebug.herokuapp.com/</a> for testing)</p>
  
  <pre><code>10.1.10.20 - bob [14/Feb/2014:18:57:05 +0000] “POST /main/foo.git/git-upload-pack HTTP/1.1” 
  
  %{IPV4:user_ip} - %{USERNAME:user_name} \[%{HTTPDATE:time_local}\]  %{QUOTEDSTRING:request}
  #not found
  </code></pre>
  
  <p>Anyone know how to get the quoted string in the above example? </p>
  
  <p>I'm brand new to grok, so perhaps I'm not approaching this correctly. </p>
  
  <p><strong>Update</strong></p>
  
  <p>Interestingly if I use the following log line and then manually type in the url it does work</p>
  
  <pre><code> bob 14/Feb/2014:18:57:05 +0000 "herp"
   #Once herp works, replace herp, with POST
   bob 14/Feb/2014:18:57:05 +0000 "POST"
   #Once POST works, keep expounding until the whole thing is in place
   autobuild 14/Feb/2014:18:57:05 +0000 "POST /main/builder.git/git-upload-pack HTTP/1.1"
  </code></pre>