Ambiguous field reference for object field

Hi,

I'm attempting to split a field which looks like:

{
  "VERSION" : "version-uk-v2.1.0-global-v2.2.0" 
}

into the following:

{
  "host" : {
    "version" : {
      "uk" : "v2.1.0",
      "global" : "v2.2.0"
    }
  }
}

I need to be able to reference the field value when setting the new field name since "uk" is variable. Here is the filter I'm using:

  if [VERSION] {
    mutate {
      split => ["VERSION", "-"]
      add_field => { "[host][version][%{[VERSION][1]}]" => "%{[VERSION][2]}" }
      add_field => { "[host][version][%{[VERSION][3]}]" => "%{[VERSION][4]}" }
      remove_field => [ "VERSION" ]
    }
  }

It seems to work, but it results in the warnings:

[2019-11-01T12:42:31,790][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference [host][version][%{[VERSION][1]}], which we expanded to the path [host, version, %{, VERSION, 1, }]; in a future release of Logstash, ambiguous Field References will not be expanded.
[2019-11-01T12:42:31,791][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference [host][version][%{[VERSION][3]}], which we expanded to the path [host, version, %{, VERSION, 3, }]; in a future release of Logstash, ambiguous Field References will not be expanded.

I've tried referencing those array elements a number of different ways but the warning still remains. What is the correct way to do this?

Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.