Fetch substring from a string in logstash filter

[Neelam_Zanvar]

Hi, I have a field called url in elasticsearch document.
The sample value for the field is /3dpassport/login
I want to extract only the first string before / that is 3dpassport and store it in a field. Tried this

copy => {
          "url" => "service_name"
        }
        split => {
          "service_name" => "/"
        }
        add_field => { "service" => "%{service_name[1]}" }

In this case
url => /3dpassport/login
service_name=> /3dpassport/login

there is no separate field created for service
After making changes in pipeline i have deleted and recreated data views

if i put it in this format
add_field => { "service" => "%{[service_name][1]}" }
i am getting service name as
service=> %{[service_name][1]}

and if i put "%{url[1]}" there is no service field generated. looks like some syntax problem accessing the array

[Badger]

@Neelam_Zanvar

copy => {
          "url" => "service_name"
        }
        split => {
          "service_name" => "/"
        }
        add_field => { "service" => "%{service_name[1]}" }

A mutate filter does things in a fixed order, and copy happens after split. add_field comes last. Use two mutate filters

    mutate { copy => { "url" => "service_name" } }
    mutate {
        split => { "service_name" => "/" }
        add_field => { "service" => "%{[service_name][1]}" }
    }