# Double quotes within double quotes in search query

**URL:** <https://community.graylog.org/t/double-quotes-within-double-quotes-in-search-query/8259>\
**Category:** Graylog Central (peer support)\
**Created:** [January 4, 2019, 7:52am UTC](https://community.graylog.org/t/double-quotes-within-double-quotes-in-search-query/8259 "2019-01-04T07:52:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![benny](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@benny](https://community.graylog.org/u/benny)\
**Post date:** [January 4, 2019, 7:52am UTC](https://community.graylog.org/t/double-quotes-within-double-quotes-in-search-query/8259/1 "2019-01-04T07:52:15Z")

</div>

Hello all,

Complete newbie to Graylog so apologies if this is an easy one, I’ve searched for the answer but can’t find what I’m looking for.

I have a log entry as follows -

“foo”:“123”,“bar”:“456”

Sometimes there are no results in foo or bar, and the entry looks like this -

“foo”:"",“bar”:""

I want to search for these no result log entries, however all my search attempts show all the results with entries. I’ve tried the following by simply adding double quotes around the log entry -

““foo”:”",“bar”:"""

But that gives me all results with entries. I’ve also tried -

““foo”:”",“bar”:""

Which fails, so is probably completely wrong!

Is anyone able point me in the right direction?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [January 4, 2019, 9:22am UTC](https://community.graylog.org/t/double-quotes-within-double-quotes-in-search-query/8259/2 "2019-01-04T09:22:26Z")

</div>

I do believe that the backslash \ is the preferred escape character. So you could try: `\"`

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [January 4, 2019, 10:45am UTC](https://community.graylog.org/t/double-quotes-within-double-quotes-in-search-query/8259/3 "2019-01-04T10:45:41Z")

</div>

Have you tried the doc?  
[http://docs.graylog.org/en/2.5/pages/queries.html](http://docs.graylog.org/en/2.5/pages/queries.html)

---

<div class="post-metadata">

**Author:** ![benny](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@benny](https://community.graylog.org/u/benny)\
**Post date:** [January 13, 2019, 4:55pm UTC](https://community.graylog.org/t/double-quotes-within-double-quotes-in-search-query/8259/4 "2019-01-13T16:55:35Z")

</div>

Apologies, I did try with backslashes, however my original attempt must have been wrong as it seems to work now with the following -

“\“foo\”:\”",\“bar\”:""

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 27, 2019, 4:55pm UTC](https://community.graylog.org/t/double-quotes-within-double-quotes-in-search-query/8259/5 "2019-01-27T16:55:41Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.