Filter username or email address within space delimited string

Elastic Stack Logstash
2

I tried to change your grok a little and see if this is what you are trying to achieve?

Grok Pattern:

%{TIMESTAMP_ISO8601:date} %{LOGLEVEL:loglevel}\s+\S+\s+%{NOTSPACE:logger}\s+(?<logerror>Unable to authenticate user)\s+%{NOTSPACE:email_address}\s+%{GREEDYDATA:exception2}

Output

{
  "date": [
    "2021-01-15 15:36:08.081"
  ],
  "YEAR": [
    "2021"
  ],
  "MONTHNUM": [
    "01"
  ],
  "MONTHDAY": [
    "15"
  ],
  "HOUR": [
    "15",
    null
  ],
  "MINUTE": [
    "36",
    null
  ],
  "SECOND": [
    "08.081"
  ],
  "ISO8601_TIMEZONE": [
    null
  ],
  "loglevel": [
    "ERROR"
  ],
  "logger": [
    "com.ixiasoft.physicalModel.TextmlSession.loginWithServerConnection:321"
  ],
  "logerror": [
    "Unable to authenticate user"
  ],
  "email_address": [
    "jane.smith@domain.com"
  ],
  "exception2": [
    "com.ixia.textmlserver.corbaimpl.exceptions.ErrorImp: HRESULT <0x0> : Login failed."
  ]
}

Hope this could help you!