Accessing first element after executing split

Hello everybody!. I cannot find a solution for the following thing. I'm splitting a hostname that is composed by a "name", a "." and a "domain". I would like to get only the name.

I.e: => lucas

I've read about the split function, which works good, but I cannot find a way to access the first element of the array after performing the split.

This is what I'm using:

mutate {
split => { "hostname_aux" => "." }

This gives me: lucas, google
I would like to get only lucas in that field.

Thank you!.

You could use a grok pattern.
match => {“hostname_aux” => “%{NOTSPACE:domain}.%{NOTSPACE:name}”}

It does not work. I ended up doing the following:

grok {
match => [
"[host][name]", "(?< auxhostname>[a-zA-Z0-9_-]+)(.%{GREEDYDATA})?"

Take into consideration that the whitespace between "<" and "auxhostname" is there because otherwise the word is not visible in this forum.


Might be too late, seeing you already have a solution, but could just use the mutate with split like this:

    mutate {
      split => { "hostname_aux" => "." }
      add_field => [ "hostname_split" , "%{[hostname_aux][0]}" ]

The first element of the array is %{[hostname_aux][0]}"





This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.