Hello,
I have a blue coat Proxy log that have a field that can either be a quouted value like "Microsoft-CryptoAPI/15.2" or a dash (-).
I captured this with %{QUOTEDSTRING:useragent} Before i found out that the value can be a dash (-)
Then the filter breaks
Any ideas from the Community?