Elasticsearch cut strings with forward slash

Elastic Stack Elasticsearch
#1

I have configured my squid proxy to send the logs to Elasticsearch 7.17.6, everything is working fine, except the USER mapping.

The string expect is DOMAIN/USER, the ELK recieves it correctly on original message but then on mapping I just see DOMIN, /USER is missed.

Screenshot_35
Screenshot_351563×453 48.5 KB

The field type is configured as keyword in mapping and index patterns.

Anyone can help me to solve this issue.

Thanks in advance

Best regards

#2

Problem fixed

In grok i must use

(%{DATA:squid.proxy.user}|-)

instead of

(%{USER:{DATA}|-)