# Gsub remplace double double ("") quotes by space
**URL:** https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070
**Category:** Logstash
**Created:** [April 23, 2018, 9:54am UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070 "2018-04-23T09:54:20Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Pierre2](https://discuss.elastic.co/u/Pierre2)
#### Post date: [April 23, 2018, 9:54am UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070/1 "2018-04-23T09:54:20Z")
I use the csv filter but some field are like that :
""toto toto" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504"
The csv filter can't parse fields if there is more that 2 double quotes in the field. That is why I want to remplace only the two double quotes at the beegining by a space. I tyed this but it didn't worked :
gsub =\> ["message"," \ " \ "," "]
I know that I can remplace all double quotes by space but I only want to remplace two double quotes
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 23, 2018, 11:06am UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070/2 "2018-04-23T11:06:43Z")
I don't understand the general purpose of those quotes. But wasn't the filter above meant to look like this?
`gsub => ["message","\"\""," "]`
---
### Author:  [@Pierre2](https://discuss.elastic.co/u/Pierre2)
#### Post date: [April 23, 2018, 11:37am UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070/3 "2018-04-23T11:37:59Z")
Yes you are right. I tried with your filter but the result is the same. It didn't remplace the "" with a space so I get the same csv error because of more that 2 double quotes in the same field. It wroks if I put this filter
`gsub => ["message","\""," "]`
to remplace all double quotes but I realy want to keep the other couple of double quote because some times the content of the second double quotes couple contains a comma and comma is my separator for the csv filter. So if the comma is between quotes it is unrecognized as separator and that's exactly what I want. That's why I only want to remplace the double double quotes. I hope it is possible.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 23, 2018, 11:44am UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070/4 "2018-04-23T11:44:58Z")
I tried the filter and it replaces "" with a space. But I think you don't actually want to replace two consecutive quotes? Could you give an example of an input and the desired output string?
---
### Author:  [@Pierre2](https://discuss.elastic.co/u/Pierre2)
#### Post date: [April 23, 2018, 11:49am UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070/5 "2018-04-23T11:49:37Z")
Yes I want to remplace two consequetive quotes. This is an input for example :
> ""toto toto" [sip:+4999999999@10.58.12.00](mailto:sip:+4999999999@10.58.12.00);user=phone;tag=8b1adde9f755210b19546545b056e2c555504"
And this is the output I want :
> toto toto" [sip:+4999999999@10.58.12.00](mailto:sip:+4999999999@10.58.12.00);user=phone;tag=8b1adde9f755210b19546545b056e2c555504"
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 23, 2018, 11:54am UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070/6 "2018-04-23T11:54:29Z")
I had executed the following test:
```
mutate { add_field => {"msg" => '""toto toto" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504"'}}
mutate { gsub => ["msg","\"\""," "] }
```
and got
`"msg" => " toto toto\" sip:+4999999999@10.58.12.00;user=phone;tag=8b1adde9f755210b19546545b056e2c555504\"",`
That looks right to me.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 21, 2018, 12:04pm UTC](https://discuss.elastic.co/t/gsub-remplace-double-double-quotes-by-space/129070/7 "2018-05-21T12:04:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.