# Logstash grok filter for quoted value OR dash
**URL:** https://discuss.elastic.co/t/logstash-grok-filter-for-quoted-value-or-dash/99094
**Category:** Logstash
**Created:** [September 1, 2017, 7:26am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-quoted-value-or-dash/99094 "2017-09-01T07:26:50Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [September 1, 2017, 7:26am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-quoted-value-or-dash/99094/1 "2017-09-01T07:26:50Z")
Hello,
I have a blue coat Proxy log that have a field that can either be a quouted value like "Microsoft-CryptoAPI/15.2" or a dash (-).
I captured this with %{QUOTEDSTRING:useragent} Before i found out that the value can be a dash (-)
Then the filter breaks
Any ideas from the Community?
---
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [September 1, 2017, 8:25am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-quoted-value-or-dash/99094/2 "2017-09-01T08:25:42Z")
Think i solved it, replaced %{QUOTEDSTRING:useragent} with (?\(\".\*\")|-)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 29, 2017, 8:25am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-quoted-value-or-dash/99094/3 "2017-09-29T08:25:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.