# How to configure Windows filebeat dissect to understand "" marks and reads this as one field

**URL:** <https://community.graylog.org/t/how-to-configure-windows-filebeat-dissect-to-understand-marks-and-reads-this-as-one-field/33489>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, filebeat-windows\
**Created:** [September 10, 2024, 3:25pm UTC](https://community.graylog.org/t/how-to-configure-windows-filebeat-dissect-to-understand-marks-and-reads-this-as-one-field/33489 "2024-09-10T15:25:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![RaitHaavel](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@RaitHaavel](https://community.graylog.org/u/RaitHaavel)\
**Post date:** [September 10, 2024, 3:25pm UTC](https://community.graylog.org/t/how-to-configure-windows-filebeat-dissect-to-understand-marks-and-reads-this-as-one-field/33489/1 "2024-09-10T15:25:53Z")

</div>

I have Windows sidecar installed and using filebeat to collect Microsoft Exchange logs to Graylog. Using dissect processor do extract log to fields.

My conf:

```auto
  processors:
    - dissect:
        tokenizer: "%{date_time},%{client_ip},%{client_hostname},%{server_ip},%{erver_hostname},%{source_context},%{connector_id},%{source},%{event_id},%{internal_message_id},%{message_id},%{network_message_id},%{recipient_address},%{recipient_status},%{total_bytes},%{recipient_count},%{related_recipient_address},%{reference},%{message_subject},%{sender_address},%{return_path},%{message_info},%{directionality},%{tenant_id},%{original_client_ip},%{original_server_ip},%{custom_data},%{transport_traffic_type},%{log_id},%{schema_version}"
        field: "message"
        target_prefix: "TRACKING"

```

My problem is that in Exchange every field can contain “” and then there can be extra commas but filebeat reads that next field starts. Can I configure filebeat to understand that all data between “” is one field even if it contains comma ?

Normal log: field1, field2, field 3  
exchange log : filed1, field2, “f,i,e,l,d,3”

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 24, 2024, 3:26pm UTC](https://community.graylog.org/t/how-to-configure-windows-filebeat-dissect-to-understand-marks-and-reads-this-as-one-field/33489/2 "2024-09-24T15:26:33Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.