Extract the fields user and service account

[Hema_Nithya]

Dec 2 08:46:55 server1 sudo[3461907]: ib12345 : TTY=pts/0 ; PWD=/home/ib12345 ; USER=root ; COMMAND=/bin/su - webadmin

I would like to extract the upi  from above ib12345

upi  ib12345
service_account webadmin 

Sometime after is empty COMMAND=/bin/su - 

[Hema_Nithya]

I tried this working 

| rex "COMMAND=\/[a-z]*\/[a-z]*\s-\s(?<service_account>[^ ]+)"

[Hema_Nithya]

Hi Thanks 

I also want to extract another field from the below  data "webadmin" as service_Account COMMAND=/bin/su - webadmin

Dec 2 08:46:55 server1 sudo[3461907]: ib12345 : TTY=pts/0 ; PWD=/home/ib12345 ; USER=root ; COMMAND=/bin/su - webadmin

[ITWhisperer]

Assuming your spacing is as shown in your example:

| rex "sudo\s*?:\s(?<upi>\S+)\s"