Extract server name from fqdn

[vijay_kaali]

in beat.hostname, some are in CAPS / small , lower /upper case characters .
To stabilize the search, i want to extract server name without fqdn and store in new field in lower case i tried following

1. mutate {
   split => { "beat.Hostname" => "." }
   add_field => { "host1" => "%{[beat][Hostname][1]}" }
   lowercase => [ "host1" ]
   }

2. mutate {
   add_field => { "host2" => "beat.Hostname"]
   split => { "host2" => "." }
   add_field => { "host1" => "%{host2[0]}" }
   lowercase => [ "host1" ]
   }

but in both cases host1 value %{[beat][Hostname][1]}" or "%{host2[0]}" or in elk
Am i missing anything

[Badger]

@vijay_kaali

split => { "beat.Hostname" => "." }
add_field => { "host1" => "%{[beat][Hostname][1]}" }

If the field name contains a period you would refer to it as beat.hostname. If the beat field is an object that contains a Hostname field then you would refer to it as [beat][Hostname]. I suspect you need to update your split option.

[vijay_kaali]

// add_field => { "host1" => "%{beat.Hostname[1]}" } //
This setting throws error

[Badger]

Is the beat field an object that contains a hostname field, or is the field named beat.hostname?

[vijay_kaali]

I am able to do this via workaround
copy nesting field to temp field
add field host1 > beat.hostname
split field host1 , "."
add_field shhost > host1[0]