How to parse a hostname

[Mark_Tellier]

Magnus,

Your recommendation worked, thanks for your prompt response.
The following replaces my hostname from esx1.acme.com to esx1.

mutate {
  split => ["syslog_hostname", "."]
}
mutate {
  replace => ["syslog_hostname", "%{[syslog_hostname][0]}"]
}

Thanks