filter-10-session.conf

filter {
  if [message] =~ /Failed to start Session [0-9]+/ {
    grok {
      match => ["message","Failed to start Session %{NUMBER:session_number} of user %{USERNAME:[user][name]}"]
      id => "user_session_failed"
      tag_on_failure => ["_grokparsefaillure","user_session_failed_grok_failed"]
    }
  }
}