# Quotes are not converted correctly **URL:** \ **Category:** Kibana\ **Created:** [October 18, 2021, 12:52pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994 "2021-10-18T12:52:10Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Sandra\_Schlichting](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandra_schlichting/32/84122_2.png) [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Post date:** [October 18, 2021, 12:52pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/1 "2021-10-18T12:52:10Z")
Dear all =) When creating [Create Rule](https://www.elastic.co/guide/en/kibana/master/create-rule-api.html) over the API, and want to search for `host:"10.250.11.11"`, then I run into problems. This is invalid JSON: ```auto "esQuery": '{ "query": { "query_string": { "query": "host:"10.250.11.11" } } }' ``` Here Kibana removes the quotes around the IP address: ```auto "esQuery": "{ \"query\": { \"query_string\": { \"query\": \"host:\"10.250.11.11\"\" } } }" ``` If I triple quote ```auto "esQuery": "{ \"query\": { \"query_string\": { \"query\": \"host:\\\"10.250.11.11\\\"\" } } }" ``` then it becomes ```auto { "query": { "query_string": { "query": "host:\"10.250.11.11\"" } } } ``` but Kibana/Elastic doesn't unescape `\"`, so the search it preforms is actually ```auto host: \" 10 250 11 11 \" ``` Notice that searches for `\"`. Where it should have been ```auto host:"10.250.11.11" ``` If I had to guess, then the problem is that it isn't possible for Kibana/Elastic to convert `"query": "host:\"10.250.11.11\""` into `"query": "host:"10.250.11.11""` as that would be invalid JSON. Hence is it impossible to create rules over the API with searches that contain `"`. Is that correct? Hugs, Sandra =) ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [October 20, 2021, 1:00pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/2 "2021-10-20T13:00:11Z")
JSON requires double-quotes around string values and keys. And in a JSON string, you can embed a double quote character by using "backslash double-quote" - `\"` (hoping that renders as the backslash character followed by the double quote character!) So your first attempt seems closest. I think this is the value you want. ```auto {"esQuery":{"query":{"query_string":{"query":"host:\"10.250.11.11\""}}}} ``` Triple quotes are largely a Kibana Dev Console thing, and aren't generally accepted in Kibana HTTP APIs, since they are not valid JSON - they're an extension of JSON. ---
**Author:** ![Sandra\_Schlichting](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandra_schlichting/32/84122_2.png) [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Post date:** [October 20, 2021, 8:52pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/3 "2021-10-20T20:52:03Z")
If I send ```auto {"esQuery":{"query":{"query_string":{"query":"host:\"10.250.11.11\""}}}} ``` then Kibana/Elastic treats the search as `host:\"` `10` `250` `11` `11` `\"`. If I had to guess then the problem lies in [Escaping\_Special\_Characters](https://lucene.apache.org/core/6_0_0/queryparser/org/apache/lucene/queryparser/classic/package-summary.html#Escaping_Special_Characters) ie `\"` will never be unescaped, as Lucene sees `\"` as it should search for `"` and not for denoting start/end of a string? I suppose the problem is that `"` can mean two different things. Eg. ```auto host:" text with a " inside " ^ ^ | +-- char to search for +-- start of string ``` or ```auto host:" text with a " inside " ^ ^ | +-- start of string +-- char to search for ``` and Lucene have no way to tell which is which and therefore treats all escaped chars a chars to search for. A since JSON requires double quotes, all other inner double quotes have to be escaped, and hence Lucene sees them as chars to search for. Or am I misunderstanding the situation? ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [October 20, 2021, 10:22pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/4 "2021-10-20T22:22:50Z")
Ah, I see what you're saying. I tried several different ways of escaping a double quote in a search running from Dev Tools. And of course it might have it's own quoting issues. No luck when trying to include the quote in the query. I did have some luck using a regexp though, and using `.` (wildcard) instead of the quote. For instance: ```auto GET .kibana/_search { "query": { "query_string": { "query": "/.*double quote . in the name.*/" } } } ``` It found a document where a field had the text `double quote " in the name`. This query isn't great, since it uses regexp, searches default fields, and uses `.*` - I wasn't able to figure out how to give it a specific field name and still work, which should make it faster. So I think we first need to figure out the query DSL for the query you want, not within alerting - either from Dev Console or via `curl`, using the `_search` API. Once we have that, hopefully we can figure out how to encode that in JSON so it gets passed along the way correctly. ---
**Author:** ![Sandra\_Schlichting](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandra_schlichting/32/84122_2.png) [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Post date:** [October 20, 2021, 10:35pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/5 "2021-10-20T22:35:32Z")
That would be great =) It would be ```auto host:"10.250.11.11" and custom4:"errors occurred" ``` Whenever JSON is involved I can't see any solution. If only the the quotes could be written as `%22`. ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [October 21, 2021, 12:27pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/6 "2021-10-21T12:27:41Z")
I'd like to see the complete DSL, that you would use in a `curl` command or in the Dev Console. Otherwise I'm just guessing about the other parts 🙂 ---
**Author:** ![Sandra\_Schlichting](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandra_schlichting/32/84122_2.png) [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Post date:** [October 21, 2021, 4:51pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/7 "2021-10-21T16:51:58Z")
Sorry, I misunderstood. Here it comes =) ```auto { "params":{ "esQuery":"{ \"query\": { \"query_string\": { \"query\": \"host:\\\"10.250.11.11\\\" and custom4:\\\"errors occurred\\\"\" } } }", "size":100, "timeWindowSize":60, "timeWindowUnit":"s", "threshold":[ "1" ], "thresholdComparator":">=", "index":[ "prod_log" ], "timeField":"@timestamp" }, "consumer":"alerts", "schedule":{ "interval":"60s" }, "tags":[ ], "name":"nonprod_test44", "enabled":true, "throttle":null, "rule_type_id":".es-query", "notify_when":"onActiveAlert", "actions":[ { "group":"query matched", "id":"_REPLACE_THIS_", "params":{ "body":"{\"system\":\"system2\",\"key\":\"nonprod_test44\",\"date\":\"{{context.date}}\",\"alert_id\":\"{{alertId}}\",\"alert_message\":\"{{alert.id}}\",\"matched_documents\":\"{{context.value}}\",\"documents\":\"[{{context.hits}}]\"}" } } ] } ``` ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [October 21, 2021, 7:15pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/8 "2021-10-21T19:15:53Z")
Sorry, I was not clear. I want to see a plain old Elasticsearch search, via `curl` or Dev Console, that performs the search you want to embed in the rule. Nothing to do with the rule 🙂 Once we have that, I can see if we can figure out how to embed that inside the rule params. I think what you pasted was your current attempt at trying to build the rule? Which doesn't work? Another thought is this - especially since I will be mostly offline soon until Monday - once you have that query, you _should_ be able to paste it into the Kibana "create alert" UI for the Elasticsearch query rule. Assuming the rule then works the way you want, you could use `curl` to get the rule data back out, to figure out how it was formatted. Get API here: [Get rule API | Kibana Guide [master] | Elastic](https://www.elastic.co/guide/en/kibana/master/get-rule-api.html) - there's also a Find API you can use, if you don't know the rule's ID which is required for the Get API - actually, you can just use the Find API unless you have lots of rules - it also returns the JSON definition of the rules. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 18, 2021, 7:16pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994/9 "2021-11-18T19:16:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.