How to extract field from source field?

[ravir_jbp]

I am trying extract "user20" from rest of "_9a4ab75c_239_process.log".  tried multiple ways but unable to separate the user name from underscore.

/app_5/appname/appanem2/logs/agent-machine4/sre/query/prot/user20_tt65rft67uu87_process.log"

[ITWhisperer]

| rex field=source "/(?<user>[^_/]+)[^/]+\.log$"