No problem, I appreciate your help.
I was able to resolve. Somehow I missed the fact that the last part of the line *Login Failure* was part of the entire expression (I switched from wildcard to regex).
Once I removed that last part it worked perfectly.
The final expression that worked to match all users except the solarwinds user and show login failures.
(L|Login Success|Login Failure|Login failed) \[user: (?!solarwinds).*