I usually test complex regex in either notepad++ or EPIC pluggin for Eclipse before incorporating it in my Perl script.
If you test  \"[^\"]+\" in notepad++ with regular expression search mode, it clearly highlights the matching portion of your log line "http_decoder: HTTP.Unknown.Tunnelling".
UPDATE : Other Monks have already suggested this solution!