# Grok QS includes quotes, how can I remove them?
**URL:** https://discuss.elastic.co/t/grok-qs-includes-quotes-how-can-i-remove-them/82195
**Category:** Logstash
**Created:** [April 12, 2017, 4:12pm UTC](https://discuss.elastic.co/t/grok-qs-includes-quotes-how-can-i-remove-them/82195 "2017-04-12T16:12:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mikemi](https://discuss.elastic.co/u/mikemi)
#### Post date: [April 12, 2017, 4:12pm UTC](https://discuss.elastic.co/t/grok-qs-includes-quotes-how-can-i-remove-them/82195/1 "2017-04-12T16:12:57Z")
I'm using the `QS` grok pattern. It includes the encapsulating quotes in the values.
For example, I'm using it to get the referrer in a custom apache log.
How can I remove the quotes before shipping over to elasticsearch?
> "agent" =\> ""Mozilla/5.0 (X11; U; Linux x86\_64; en-US; rv:1.9.2.4) Gecko/20100614 Ubuntu/10.04 (lucid) Firefox/3.6.4"",
---
### Author:  [@eperry](https://discuss.elastic.co/u/eperry)
#### Post date: [April 13, 2017, 12:16am UTC](https://discuss.elastic.co/t/grok-qs-includes-quotes-how-can-i-remove-them/82195/2 "2017-04-13T00:16:24Z")
yup that is the problem using %{QA:agent} annoying isn't it
I use "%{DATA:agent}"
though you could always use mutate with gsub to search and replace quotes
the only other option for you is to rewrite the QS defination not to capture the "'s but never found a good answer on that
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 13, 2017, 7:04am UTC](https://discuss.elastic.co/t/grok-qs-includes-quotes-how-can-i-remove-them/82195/3 "2017-04-13T07:04:31Z")
The mutate filter's gsub option can be used to remove the quotes.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 11, 2017, 7:04am UTC](https://discuss.elastic.co/t/grok-qs-includes-quotes-how-can-i-remove-them/82195/4 "2017-05-11T07:04:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.