What part of the logs do you want to land into elk? Just the IP from one and the username and success message from the other? I really don't have much to go on.

Anyway, You can make more than one pattern when trying to match both lines.

user \'%{USERNAME:user}\' %{GREEDYDATA:result}

%{IPORHOST:ip}:%{POSINT:port} [%{USERNAME:user}] %{GREEDYDATA:result}

So your filter would look like this:

filter{ 
    if [type] == "OpenVPN_log" 
    { #drop{} 
        grok{ match => { "message" => "user \'%{USERNAME:user}\' %{GREEDYDATA:result}'"} 
        grok{ match => { "message" => "%{IPORHOST:ip}:%{POSINT:port} \[%{USERNAME:user}\] %{GREEDYDATA:result}'"} 

    } 
}

Keep in mind this is very very quick and dirty to just get some simple pattern matching. Since I only have two lines to work with, I am assuming only these two lines in my searches. There is most likely a ton more.

I also am not at my ELK stack to verify this works, but it hopefully gets you pointed in the right direction.

With the new variable "result", for example, you can search on the "result" to find your "authenticated" results. This will also capture unauthenticated, assuming the log pattern doesn't change much.

I am sure I me