# Forwarder adds escapes to all quotes in log messages

**URL:** https://discuss.elastic.co/t/forwarder-adds-escapes-to-all-quotes-in-log-messages/32854
**Category:** Logstash
**Created:** [October 23, 2015, 1:01pm UTC](https://discuss.elastic.co/t/forwarder-adds-escapes-to-all-quotes-in-log-messages/32854 "2015-10-23T13:01:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![crazyphil](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@crazyphil](https://discuss.elastic.co/u/crazyphil)
#### Post date: [October 23, 2015, 1:01pm UTC](https://discuss.elastic.co/t/forwarder-adds-escapes-to-all-quotes-in-log-messages/32854/1 "2015-10-23T13:01:08Z")

</div>

So I am at my wits end trying to get either a working grok filter, or getting LSF to send data properly.

The data being sent looks like this:

23/Oct/2015:01:57:16 +0000 1.2.3.4/- "Status:200" "POST /api/rest/stats/call HTTP/1.1" "{\x22data\x22: [{\x22val\x22:\x22dummy\x22, \x22ts\x22: 109683, \x22avgJitter\x22: 0, \x22id\x22: \x2215d61\_293b830\x22, \x22rxCodec\x22: \x22G.722.1C\x22, \x22rx\x22: 114061, \x22drop\x22: 0, \x22jitter\x22: 2, \x22key\x22: \x22callinfo-audio\x22}], \x22mac\x22: \x220004f2fc3311\x22, \x22hwrev\x22: \x225\x22, \x22bld\x22: \x2211424\x22, \x22ver\x22: \x225.4.0\x22, \x22hwreg\x22: \x220\x22, \x22hwname\x22:\x228800\x22, \x22vdt\x22: \x2219-Oct-15 14:39\x22, \x22hwpn\x22: \x223111-65290-001\x22}" 28475 1 ECDHE-RSA-AES256-GCM-SHA384 5 "-" "-"

But when LSF sends it to LS, it escapes " and other data so when LS receives it this is what I get:  
23/Oct/2015:01:57:16 +0000 1.2.3.4/- "Status:200" "POST /api/rest/stats/call HTTP/1.1" "{\x22data\x22: [{\x22val\x22:\x22dummy\x22, \x22ts\x22: 109683, \x22avgJitter\x22: 0, \x22id\x22: \x2215d61\_293b830\x22, \x22rxCodec\x22: \x22G.722.1C\x22, \x22rx\x22: 114061, \x22drop\x22: 0, \x22jitter\x22: 2, \x22key\x22: \x22callinfo-audio\x22}], \x22mac\x22: \x220004f2fc3311\x22, \x22hwrev\x22: \x225\x22, \x22bld\x22: \x2211424\x22, \x22ver\x22: \x225.4.0\x22, \x22hwreg\x22: \x220\x22, \x22hwname\x22:\x228800\x22, \x22vdt\x22: \x2219-Oct-15 14:39\x22, \x22hwpn\x22: \x223111-65290-001\x22}" 28475 1 ECDHE-RSA-AES256-GCM-SHA384 5 "-" "-"

So I wrote and tested a grok filter based on the expected log message format:  
%{HTTPDATE} %{IP:clientip}%{NOTSPACE}%{NOTSPACE} %{QS:status} %{QS:method} %{QS:body} %{NUMBER:con} %{NUMBER:conreq} (?(\w+-\w+){4}) %{NUMBER:bytessent} %{QS:refer} %{QS:useragent}

Once I figured out the problem, I rewrote and tested the grok filter to account for all the escapes:

%{HTTPDATE:timestamp} %{IP:clientip}%{NOTSPACE}%{NOTSPACE} \"Status:%{NUMBER:status}\" \"(?(.+))\" \"(?\<request\_body\>(.+))\" %{NUMBER:connection} %{NUMBER:connection\_request} (?\<ssl\_cipher\>(\w+-\w+){4}) %{NUMBER:body\_bytes\_sent} \"(?\<http\_referer\>.+)\" \"(?\<http\_user\_agent\>.+)\"

However, LS still gives a ton of \_grokparseerror messages and refuses to process the message no matter what I do.

Any suggestions?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/forwarder-adds-escapes-to-all-quotes-in-log-messages/32854/2 "2017-07-06T05:25:38Z")

</div>