I have upgraded logstash from 6.2 > 6.8 and currently in 7.6.2-1
mutate { add_field => { "shorthost2" => "%{[pythonbeat][Hostname]}" } }
mutate {
split => [ "shorthost2", "." ]
add_field => { "shorthost" => "%{shorthost2[0]}" }
}
the above same code , throws
[logstash.filters.mutate ][main] Exception caught while applying mutate filter {:exception=>"Invalid FieldReference: shorthost2[0]
"}
hostname varies with/without fqdn so i changed but still same error
mutate { add_field => { "shorthost2" => "%{[pythonbeat][Hostname]}.abc" } }
after i remove following code it is getting indexed and shorthost2 shows as array
add_field => { "shorthost" => "%{shorthost2[0]}" }
any bug on new logstash filter