# Parsing log with "@" as token

**URL:** <https://discuss.elastic.co/t/parsing-log-with-as-token/34473>\
**Category:** Logstash\
**Created:** [November 12, 2015, 11:15pm UTC](https://discuss.elastic.co/t/parsing-log-with-as-token/34473 "2015-11-12T23:15:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![xtingray](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xtingray/32/5350_2.png) [@xtingray](https://discuss.elastic.co/u/xtingray)\
**Post date:** [November 12, 2015, 11:15pm UTC](https://discuss.elastic.co/t/parsing-log-with-as-token/34473/1 "2015-11-12T23:15:16Z")

</div>

I'm having a hard time parsing a log with this configuration:

```
username/user_id@domain

```

Example:

```
jhon/999@test.com

```

I am using this grok expression:

```
match => "%{DATA:username}/%{DATA:user_id}\@%{DATA:domain}"

```

But the "domain" variable is always lost. Any suggestion to get the three values in a clean way?

---

<div class="post-metadata">

**Author:** ![xtingray](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xtingray/32/5350_2.png) [@xtingray](https://discuss.elastic.co/u/xtingray)\
**Post date:** [November 13, 2015, 12:35am UTC](https://discuss.elastic.co/t/parsing-log-with-as-token/34473/2 "2015-11-13T00:35:31Z")

</div>

Finally I could solve it using this grok expression:

```
match => "%{DATA:username}/%{USER:user_id}@%{HOSTNAME:domain}"
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 13, 2015, 6:30am UTC](https://discuss.elastic.co/t/parsing-log-with-as-token/34473/3 "2015-11-13T06:30:51Z")

</div>

Yeah, be very careful with more than one DATA or GREEDYDATA in the same expressions. Use stricter patterns whenever you can.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/parsing-log-with-as-token/34473/4 "2017-07-06T05:22:55Z")

</div>