# Quotes in Grok

**URL:** https://discuss.elastic.co/t/quotes-in-grok/62136
**Category:** Logstash
**Created:** [October 4, 2016, 9:00am UTC](https://discuss.elastic.co/t/quotes-in-grok/62136 "2016-10-04T09:00:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Tim\_James](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_james/32/55697_2.png) [@Tim\_James](https://discuss.elastic.co/u/Tim_James)
#### Post date: [October 4, 2016, 9:00am UTC](https://discuss.elastic.co/t/quotes-in-grok/62136/1 "2016-10-04T09:00:55Z")

</div>

Hi,

I'm having trouble trying to parse log lines like this (but much longer):

"timestamp":"2016-02-10 00:10:33","level":"ERROR"

So everything is in double quotes.

I just want a simple way to get the fields separated and without quotes.

Could someone point me in the right direction?

Thanks

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 4, 2016, 9:27am UTC](https://discuss.elastic.co/t/quotes-in-grok/62136/2 "2016-10-04T09:27:54Z")

</div>

Is this JSON data? Use the json filter (or codec).

---

<div class="post-metadata">

### Author: ![Tim\_James](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_james/32/55697_2.png) [@Tim\_James](https://discuss.elastic.co/u/Tim_James)
#### Post date: [October 4, 2016, 10:22am UTC](https://discuss.elastic.co/t/quotes-in-grok/62136/3 "2016-10-04T10:22:01Z")

</div>

Unfortunately it's not proper JSON , but I might be able to use that, thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/quotes-in-grok/62136/4 "2017-07-06T04:35:56Z")

</div>