I have a field named AccountName which has values like this abc$, abc234$ (just two values in field).
i am using mutate filter to split it into parts and then use add_field to insert values into another field. I have logstash, elasticsearch and kibana version 7.0 and I am following tutorial to do it which is made specifically towards 7.0.
here is my script
mutate {
split => ["AccountName", ","]
add_field => { "AccountName1" => "%{AccountName[0]}" }
add_field => { "AccountName2" => "%{AccountName[1]}" }
remove_field => [AccountName]
}
if [AccountName2] == "%{AccountName[1]}"
{
mutate {
replace => { "AccountName2" => "-" }
}
}
if [AccountName1] == "%{AccountName[0]}"
{
mutate {
replace => { "AccountName1" => "-" }
}
}
It was working just fine for previous versions but now it is not working. I am getting following error. I dont get whats wrong with my code.
[2019-04-26T11:03:05,919][FATAL][logstash.runner ] An unexpected error occurred! {:error=>java.lang.IllegalStateException: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference:
AccountName[0], :backtrace=>["org.logstash.execution.WorkerLoop.run(org/logstash/execution/WorkerLoop.java:85)", "jdk.internal.reflect.GeneratedMethodAccessor33.invoke(jdk/internal/reflect/GeneratedMethodAccessor33)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:440)", "org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:304)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:235)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:286)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:270)", "java.lang.Thread.run(java/lang/Thread.java:834)"]}