Im use grok patterns to extract info from Palo Alto log. But im try to extract a substring on description field like this
authenticated for user 'newUser'. auth profile 'D', server profile 'LTY', server address '', From: 22.214.171.124.
I want to extract the value next to user, between '' and the IP next to "From" but I dont have idea the correct form.