Check logfile with powershell

I have a special task and I don't know what is the best idea to solve this task.

We have a syslog server in our environment which is collecting all Windows Logs from the Servers.

We can do an API call to the Syslog server, which returns a JSON with the Property "Content" (Which includes the whole logentry).

Now I have the following case: We are logging the failed logons on the VDA Servers and now we want to count how many times a userlogon failed in an hour for each user which has an entry in the log system.

For example: User tes_baa has 3 Failed Logon attemps User aas_eaa has 2 Failed Logon attemps

But my Problem is, I can't go easy throught the JSON File which the Syslog server returned, because the Username is Dynamic (Take a look at the "Content" Property of the JSON-File) My Idea was to create a regex to filter the username of each JSON and add the Username to an array and count the Array. Why Regex? Because Every Username has the following Syntax: "3 Characters_Name" (In the file below sqa_augstb) Or what would be your idea?

    [20:12:38] [INF] An account failed to log on.

Subject:
    Security ID:        S-1-0-0
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        S-1-0-0
    Account Name:       sqa_augstb
    Account Domain:     

Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xC000006D
    Sub Status:     0xC000006A

Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:   VDASW2
    Source Network Address: 10.10.2.127
    Source Port:        60973

Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. 

As in my comment, I'm not super good with regex but supposing the Account Name does not have . or white spaces \s you can use this regex:

Assuming the log file is saved on the variable $log:

PS /> ([regex]'\w{3}_\w+').Matches($log)

Groups   : {0}
Success  : True
Name     : 0
Captures : {0}
Index    : 292
Length   : 10
Value    : sqa_august

• \w \w matches any word character (equivalent to [a-zA-Z0-9_])
• {3} matches the previous token exactly 3 times
• _ matches the character _ literally
• \w+ matches any word character between one and unlimited times, as many times as possible, giving back as needed (greedy)

And suppossing it can have white spaces \s and . you can use this regex:

PS /> ([regex]'\w{3}_[\w?\.?\s]+[\r\n]{1}').Matches($log)

Groups   : {0}
Success  : True
Name     : 0
Captures : {0}
Index    : 292
Length   : 17
Value    : sqa_ a..u.gu st

• ? matches the previous element zero or one time
• \. matches a literal dot
• \s matches whitespace
• [\w?\.?\s]+ this group will match any word that may or may not be followed by a \. or \s between one and unlimited times
• [\r\n]{1} matches a carriage return or new line exactly 1 time. I added this so it knows where to stop, if we remove this it will continue matching the new lines... There is probably a better way for this :P

The .trim() or .trimEnd() will be necessary to remove the trailing white space generated by [\r\n]{1}