Parsing log with "@" as token

[xtingray (Gustav Gonzalez)]

I'm having a hard time parsing a log with this configuration:

username/user_id@domain

Example:

jhon/999@test.com

I am using this grok expression:

match => "%{DATA:username}/%{DATA:user_id}\@%{DATA:domain}"

But the "domain" variable is always lost. Any suggestion to get the three values in a clean way?

[xtingray (Gustav Gonzalez)]

Finally I could solve it using this grok expression:

match => "%{DATA:username}/%{USER:user_id}@%{HOSTNAME:domain}"

[magnusbaeck (Magnus Bäck)]

Yeah, be very careful with more than one DATA or GREEDYDATA in the same expressions. Use stricter patterns whenever you can.