Its a space issue with the grok parsing.
two images.... one stock as per your recommendation ( which we'd already tried )
second with alteration to the username and inserting . between some and user
So im on 7.5 ES fully updated at the beginning on this week and in my mind, this means something has gone wrong with the existing patterns that %{USERNAME} makes use of, or something else is foobar'd in respect to how it parses "spaces" in data.
This guy has exactly same issue