In the page :
https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split
In the "Describtion" section,it show the field "split" type as an array.
filter {
mutate {
split => ["hostname", "."]
add_field => { "shortHostname" => "%{hostname[0]}" }
}
But in the "split" section, it is described as an hash type.
split
- Value type is hash
- There is no default value for this setting.
Split a field to an array using a separator character. Only works on string fields.
Example:
filter { mutate { split => { "fieldname" => "," } } }
It's not good for a fresh hand.