Invalid FieldReference

Elastic Stack Logstash
1

I have a field named AccountName which has values like this abc$, abc234$ (just two values in field).

i am using mutate filter to split it into parts and then use add_field to insert values into another field. I have logstash, elasticsearch and kibana version 7.0 and I am following tutorial to do it which is made specifically towards 7.0.

here is my script

mutate {
      split => ["AccountName", ","]
      add_field => { "AccountName1" => "%{AccountName[0]}" }
      add_field => { "AccountName2" => "%{AccountName[1]}" }
      remove_field => [AccountName]
      
      }

      if [AccountName2] == "%{AccountName[1]}"
    {
      mutate {
    replace => { "AccountName2" => "-" }
  }
  }

  if [AccountName1] == "%{AccountName[0]}"
      {
      mutate {
    replace => { "AccountName1" => "-" }
  }
  }

It was working just fine for previous versions but now it is not working. I am getting following error. I dont get whats wrong with my code.

[2019-04-26T11:03:05,919][FATAL][logstash.runner ] An unexpected error occurred! {:error=>java.lang.IllegalStateException: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: AccountName[0], :backtrace=>["org.logstash.execution.WorkerLoop.run(org/logstash/execution/WorkerLoop.java:85)", "jdk.internal.reflect.GeneratedMethodAccessor33.invoke(jdk/internal/reflect/GeneratedMethodAccessor33)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:440)", "org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:304)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:235)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:286)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:270)", "java.lang.Thread.run(java/lang/Thread.java:834)"]}

2 Likes
2

Change "%{AccountName[0]}" to "%{[AccountName][0]}" throughout.

4 Likes
3

Hi
Thank you very much for your response and sorry for late response. Your solution worked perfectly. I am guessing the documentation is not updated for latest version.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.