Grok capture index value with different patterns within the message

Elastic Stack Logstash
1

Thank you in advance,

 Please advise how can I capture logs that have different pattern, let say for username, the value shows [ldap:my_user01], and I created grok to capture this by  \[ldap0:%{USERNAME:username}\], then later on, I found out some logs wth non ldap username, the value shows [ANON], how can I extract just the username (without ldap:).....
2

You can ? to make a capture group optional.

grok { match => { "field" => "^\[(%{WORD:ldap}:)?%{USER:user}\]$" } }
3

Thank you so much..appreciate it..