After logstash upgrade split array not working

I have upgraded logstash from 6.2 > 6.8 and currently in 7.6.2-1
mutate { add_field => { "shorthost2" => "%{[pythonbeat][Hostname]}" } }
mutate {
split => [ "shorthost2", "." ]
add_field => { "shorthost" => "%{shorthost2[0]}" }
}

the above same code , throws
[logstash.filters.mutate ][main] Exception caught while applying mutate filter {:exception=>"Invalid FieldReference: shorthost2[0]"}

hostname varies with/without fqdn so i changed but still same error
mutate { add_field => { "shorthost2" => "%{[pythonbeat][Hostname]}.abc" } }

after i remove following code it is getting indexed and shorthost2 shows as array
add_field => { "shorthost" => "%{shorthost2[0]}" }

any bug on new logstash filter

Change the %{shorthost2[0]} to %{[shorthost2][0]}

Thanks Rahul . it works . does syntax change in 7.x . Even current documentation says
filter { mutate { split => ["hostname", "."] add_field => { "shortHostname" => "%{hostname[0]}" } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.