# Mutate filter a word between quotes

**URL:** <https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844>\
**Category:** Logstash\
**Created:** [March 26, 2019, 1:59am UTC](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844 "2019-03-26T01:59:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Woolis\_Xiibil\_Peek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/woolis_xiibil_peek/32/42830_2.png) [@Woolis\_Xiibil\_Peek](https://discuss.elastic.co/u/Woolis_Xiibil_Peek)\
**Post date:** [March 26, 2019, 1:59am UTC](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844/1 "2019-03-26T01:59:34Z")

</div>

Hi.

I want to create a filter in a logstash configuration with a word between quotation marks. Something like this "word":"1234567890"

I want to mutate this part of the log message so I can create a new field for the phrase after de colon, but without the quotation marks. Something like this 1234567890.

My problem is how I can create a mutate filter so I split this part of the log so I get the goal.

I try something like this

mutate {  
split =\> {"log\_tmp" =\> "\"Word\""}  
}

I find searching that with this expression \" quotation mark is treated as a part of the text. But it seems didn't work.

Please help 🙏

Thank you.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 26, 2019, 1:56pm UTC](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844/2 "2019-03-26T13:56:09Z")

</div>

How about this?

```
grok { match => { "message" => '"word":"%{NUMBER:n}"' } }
```

---

<div class="post-metadata">

**Author:** ![Woolis\_Xiibil\_Peek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/woolis_xiibil_peek/32/42830_2.png) [@Woolis\_Xiibil\_Peek](https://discuss.elastic.co/u/Woolis_Xiibil_Peek)\
**Post date:** [March 26, 2019, 8:35pm UTC](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844/3 "2019-03-26T20:35:21Z")

</div>

Mmmm 🤔

I will try it and let you know.

Thank you.

---

<div class="post-metadata">

**Author:** ![Woolis\_Xiibil\_Peek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/woolis_xiibil_peek/32/42830_2.png) [@Woolis\_Xiibil\_Peek](https://discuss.elastic.co/u/Woolis_Xiibil_Peek)\
**Post date:** [April 4, 2019, 6:03pm UTC](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844/4 "2019-04-04T18:03:52Z")

</div>

Works very well.

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2019, 6:03pm UTC](https://discuss.elastic.co/t/mutate-filter-a-word-between-quotes/173844/5 "2019-05-02T18:03:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.