# Double quotes inside field: grok failure / unable to remove

**URL:** https://discuss.elastic.co/t/double-quotes-inside-field-grok-failure-unable-to-remove/225903
**Category:** Logstash
**Created:** [March 31, 2020, 3:34pm UTC](https://discuss.elastic.co/t/double-quotes-inside-field-grok-failure-unable-to-remove/225903 "2020-03-31T15:34:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![holobolo0815](https://avatars.discourse-cdn.com/v4/letter/h/ecc23a/32.png) [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)
#### Post date: [March 31, 2020, 3:34pm UTC](https://discuss.elastic.co/t/double-quotes-inside-field-grok-failure-unable-to-remove/225903/1 "2020-03-31T15:34:48Z")

</div>

I have a message like this:

```
result=accept, user=username, extip=1.2.3.4, nasip=5.6.7.8, realm=user(realm)"Tue Mar 31 16:59:24 2020"4KalZzYgN, internalevent= 

```

I am filtering like follows

```
kv {
  source => "msg"
  field_split => ","
}

mutate {
  gsub => [
    "realm", "\"", ""
  ]
}
grok {
  match => {
    "realm" => '\((?<realmx>.*)\)'
  }
}
if [realmx] {
  mutate {
    replace => {
      "realm" => "%{realmx}"
    }
  }
}

```

I have tried getting rid of the double quotes in the "realm" field. But it just won't remove them and also grok fails, probably because of the quotes.

In the end all I want to do is extract the string between parentheses.

How do I tackle this?

Thanks,  
Marki

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 31, 2020, 4:02pm UTC](https://discuss.elastic.co/t/double-quotes-inside-field-grok-failure-unable-to-remove/225903/2 "2020-03-31T16:02:01Z")

</div>

There are spaces in your key names

```
    " nasip" => "5.6.7.8",
    " realm" => "user(realm)\"Tue Mar 31 16:59:24 2020\"4KalZzYgN",

```

add

```
trim_key => " "

```

to your kv filter.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 28, 2020, 4:02pm UTC](https://discuss.elastic.co/t/double-quotes-inside-field-grok-failure-unable-to-remove/225903/3 "2020-04-28T16:02:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.