# Filter out two keywords from similiar lines **URL:** \ **Category:** Logstash\ **Created:** [April 19, 2018, 1:04am UTC](https://discuss.elastic.co/t/filter-out-two-keywords-from-similiar-lines/128610 "2018-04-19T01:04:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![expert1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/expert1/32/126753_2.png) [@expert1](https://discuss.elastic.co/u/expert1)\ **Post date:** [April 19, 2018, 1:04am UTC](https://discuss.elastic.co/t/filter-out-two-keywords-from-similiar-lines/128610/1 "2018-04-19T01:04:40Z")
Hi, I'm going to filter out `user` and `result`(Failed/error/Accepted) from below lines. Failed password for root from 172.16.81.178 port 55152 ssh2 Accepted password for root from 172.16.81.178 port 55152 ssh2 Accepted keyboard-interactive/pam for root from 172.16.81.178 port 55199 ssh2 error: PAM: Failure setting user credentials for hongquan from 172.16.232.202 error: PAM: Authentication failure for root from 172.16.81.178 What I expect is: Failed, root Accepted,root error, hongquan error,root Actually I did it by writing 2 similiar grok filters, which is pretty ugly. Thanks. ---
**Author:** ![expert1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/expert1/32/126753_2.png) [@expert1](https://discuss.elastic.co/u/expert1)\ **Post date:** [April 20, 2018, 4:40am UTC](https://discuss.elastic.co/t/filter-out-two-keywords-from-similiar-lines/128610/2 "2018-04-20T04:40:46Z")
seems this works. //match =\> ["message", "%{WORD:method} (.\*) for %{USERNAME:user} from %{IP:src\_host}"] ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 18, 2018, 4:43am UTC](https://discuss.elastic.co/t/filter-out-two-keywords-from-similiar-lines/128610/3 "2018-05-18T04:43:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.