Help with logstash json output to split a field in multiple variables and combine them to a new field

to create a new field you can use mutate add_field. but, from where you are getting "403/1/1". hoping 403 from dn and what about 1/1 ? end part of dn or static ?