# Help with this grok **URL:** \ **Category:** Logstash\ **Created:** [April 12, 2023, 9:14am UTC](https://discuss.elastic.co/t/help-with-this-grok/329817 "2023-04-12T09:14:36Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Post date:** [April 12, 2023, 9:14am UTC](https://discuss.elastic.co/t/help-with-this-grok/329817/1 "2023-04-12T09:14:36Z")
Need a grok filter that parses out the account (the peacesat) from these two types of logs Case 1: `Apr 11 14:26:55 mail saslauthd[15405]: auth_zimbra: peacesat@uhtasi.org auth failed: authentication failed for [peacesat@whtasi.org]` Case 2: `Apr 11 14:21:03 mail saslauthd[15406]: auth_zimbra: peacesat auth failed: authentication failed for [peacesat]` Thanks ---
**Author:** ![TimBosman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timbosman/32/84120_2.png) [@TimBosman](https://discuss.elastic.co/u/TimBosman)\ **Post date:** [April 12, 2023, 9:28am UTC](https://discuss.elastic.co/t/help-with-this-grok/329817/2 "2023-04-12T09:28:39Z")
Hey, Are you sure that you want to use grok? I think [Dissect](https://www.elastic.co/blog/logstash-dude-wheres-my-chainsaw-i-need-to-dissect-my-logs) is better here. [Grok](https://www.elastic.co/blog/do-you-grok-grok) uses regular expressions, while dissect looks at delimiters. This makes Dissect faster. It looks like these logs share the same delimiters ("[" & ":" & "]") . Please let me know what you think, Tim ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 10, 2023, 9:29am UTC](https://discuss.elastic.co/t/help-with-this-grok/329817/3 "2023-05-10T09:29:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.