I have the username filed extraction as follows in the props.conf which extracts the email address:-
[sourcetype_X] EXTRACT-XYZ = username="(?<user>[^+\"]*)"
which extracts the field as follows
firstname.lastname@example.org email@example.com firstname.lastname@example.org ABC-DEF
Now what would be regex stanza to extract the username as follows from the above
x12345 y67891 z45787 ABC-DEF