Ambiguous in documentation which describe logstash filter plugin "mutate -> split"

In the page :

In the "Describtion" section,it show the field "split" type as an array.
filter {
mutate {
split => ["hostname", "."]
add_field => { "shortHostname" => "%{hostname[0]}" }

But in the "split" section, it is described as an hash type.


  • Value type is hash
  • There is no default value for this setting.

Split a field to an array using a separator character. Only works on string fields.


filter { mutate { split => { "fieldname" => "," } } }

It's not good for a fresh hand.

I agree this can seem confusing, but the truth is either one will work. If you supply an array it is used as if it were a hash.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.