Filter username or email address within space delimited string

I'm trying to create a Logstash filter using Grok for the following log event:

2021-01-15 15:36:08.081 ERROR   t:44    com.ixiasoft.physicalModel.TextmlSession.loginWithServerConnection:321  Unable to authenticate user com.ixia.textmlserver.corbaimpl.exceptions.ErrorImp: HRESULT <0x0> : Login failed.

Using the Grok Debugger I've come up with the following pattern match thus far:

%{TIMESTAMP_ISO8601:date} %{LOGLEVEL:loglevel}\s*\S+\s*%{NOTSPACE:logger}\s*%{GREEDYDATA:exception} %{USER:user} %{GREEDYDATA:exception2}

I know the 1st %{GREEDYDATA:exception} is not right, but I can't figure how to get past the "Unable to authenticate user" string so that I can capture the "user" field. I assume it needs to be some Regex pattern but can some one help me with this?

My ultimate goal is to be able to set an alarm in Kibana so I will need to be able to search for ("loglevel:ERROR" and "Unable to authenticate user"), and be able to display the "user" field. Ultimately, I think these are the fields I need to parse from the above log event:

"date" => "2021-01-15 15:36:08.081", 
"loglevel" => "ERROR", 
"user" => "jsmith", "jane.smith", ""
("user" could be any of the 3 patterns.)

Could some one please help with the grok pattern?


I tried to change your grok a little and see if this is what you are trying to achieve?

Grok Pattern:

%{TIMESTAMP_ISO8601:date} %{LOGLEVEL:loglevel}\s+\S+\s+%{NOTSPACE:logger}\s+(?<logerror>Unable to authenticate user)\s+%{NOTSPACE:email_address}\s+%{GREEDYDATA:exception2}


  "date": [
    "2021-01-15 15:36:08.081"
  "YEAR": [
  "HOUR": [
  "MINUTE": [
  "SECOND": [
  "ISO8601_TIMEZONE": [
  "loglevel": [
  "logger": [
  "logerror": [
    "Unable to authenticate user"
  "email_address": [
  "exception2": [
    "com.ixia.textmlserver.corbaimpl.exceptions.ErrorImp: HRESULT <0x0> : Login failed."

Hope this could help you!

Thank you @kavierkoo, your solution works. I think I was expecting it to be more complicated than it actually is.

Glad that helped you!