# Two strings with one grok
**URL:** https://discuss.elastic.co/t/two-strings-with-one-grok/309646
**Category:** Logstash
**Created:** [July 14, 2022, 12:44pm UTC](https://discuss.elastic.co/t/two-strings-with-one-grok/309646 "2022-07-14T12:44:51Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@PJss](https://discuss.elastic.co/u/PJss)
#### Post date: [July 14, 2022, 12:44pm UTC](https://discuss.elastic.co/t/two-strings-with-one-grok/309646/1 "2022-07-14T12:44:51Z")
Hello, please help to read this two strings with one grok rule
first: `mgmgmg : TTY=unknown ; PWD=/usr/local/gtail/basecomps/deploy/cache ; USER=root ; ENV=HEALTHCHECK=no BACKUP=no ; COMMAND=/usr/bin/dpkg --install goserver_12.08.SP48_amd64.deb`
second: ` root : TTY=unknown ; PWD=/usr/local/autils/auto_update ; USER=root ; COMMAND=/bin/systemctl stop goserver`
The pattern i got only works with second data string, how can i do it right?
```auto
%{USERNAME:username} : TTY=%{WORD:tty} ; PWD=%{PATH:pwd} ; USER=%{USERNAME:username1} ; COMMAND=%{GREEDYDATA:command}
```
---
### Author:  [@PJss](https://discuss.elastic.co/u/PJss)
#### Post date: [July 14, 2022, 2:22pm UTC](https://discuss.elastic.co/t/two-strings-with-one-grok/309646/2 "2022-07-14T14:22:23Z")
I make two match strings for this data, is it correct?
---
### Author:  [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)
#### Post date: [July 14, 2022, 3:25pm UTC](https://discuss.elastic.co/t/two-strings-with-one-grok/309646/3 "2022-07-14T15:25:13Z")
Hello @PJss
There is a slight change in 1st pattern, Hence we have to create accordingly, thus try the below
```auto
grok
{
match =>
{
"message" => ['%{USERNAME:username} : TTY=%{WORD:tty} ; PWD=%{PATH:pwd} ; USER=%{USERNAME:username1} ; COMMAND=%{GREEDYDATA:command}', '%{USERNAME:username} : TTY=%{WORD:tty} ; PWD=%{PATH:pwd} ; USER=%{USERNAME:username1} ; ENV=HEALTHCHECK=%{WORD:healthcheck} BACKUP=%{WORD:backup} ; COMMAND=%{GREEDYDATA:command}']
}
}
```
Keep Posted!!! Thanks !!!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 14, 2022, 6:09pm UTC](https://discuss.elastic.co/t/two-strings-with-one-grok/309646/4 "2022-07-14T18:09:32Z")
Personally I would not use grok, but kv instead
```
dissect { mapping => { "message" => "%{}: %{[@metadata][kvData]}" } }
kv { source => "[@metadata][kvData]" field_split_pattern => " ; " whitespace => "strict" }
```
which will produce
```
"COMMAND" => "/usr/bin/dpkg --install goserver_12.08.SP48_amd64.deb",
"USER" => "root",
"PWD" => "/usr/local/gtail/basecomps/deploy/cache",
"ENV" => "HEALTHCHECK=no BACKUP=no",
"TTY" => "unknown",
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 11, 2022, 6:09pm UTC](https://discuss.elastic.co/t/two-strings-with-one-grok/309646/5 "2022-08-11T18:09:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.