# Invalid FieldReference

**URL:** https://discuss.elastic.co/t/invalid-fieldreference/178721
**Category:** Logstash
**Created:** [April 26, 2019, 8:11pm UTC](https://discuss.elastic.co/t/invalid-fieldreference/178721 "2019-04-26T20:11:20Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)
#### Post date: [April 26, 2019, 8:11pm UTC](https://discuss.elastic.co/t/invalid-fieldreference/178721/1 "2019-04-26T20:11:20Z")

</div>

I have a field named AccountName which has values like this `abc$, abc234$` (just two values in field).

i am using mutate filter to split it into parts and then use add\_field to insert values into another field. I have logstash, elasticsearch and kibana version 7.0 and [I am following tutorial to do it which is made specifically towards 7.0.](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#_description_131)

here is my script

```
mutate {
      split => ["AccountName", ","]
      add_field => { "AccountName1" => "%{AccountName[0]}" }
      add_field => { "AccountName2" => "%{AccountName[1]}" }
      remove_field => [AccountName]
      
      }

      if [AccountName2] == "%{AccountName[1]}"
    {
      mutate {
    replace => { "AccountName2" => "-" }
  }
  }

  if [AccountName1] == "%{AccountName[0]}"
      {
      mutate {
    replace => { "AccountName1" => "-" }
  }
  }

```

It was working just fine for previous versions but now it is not working. I am getting following error. I dont get whats wrong with my code.

> [2019-04-26T11:03:05,919][FATAL][logstash.runner] An unexpected error occurred! {:error=\>java.lang.IllegalStateException: org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `AccountName[0]`, :backtrace=\>["org.logstash.execution.WorkerLoop.run(org/logstash/execution/WorkerLoop.java:85)", "jdk.internal.reflect.GeneratedMethodAccessor33.invoke(jdk/internal/reflect/GeneratedMethodAccessor33)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:440)", "org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:304)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.start\_workers(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:235)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:286)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:270)", "java.lang.Thread.run(java/lang/Thread.java:834)"]}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 27, 2019, 12:34pm UTC](https://discuss.elastic.co/t/invalid-fieldreference/178721/2 "2019-04-27T12:34:22Z")

</div>

Change "%{AccountName[0]}" to "%{[AccountName][0]}" throughout.

---

<div class="post-metadata">

### Author: ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)
#### Post date: [April 29, 2019, 7:14pm UTC](https://discuss.elastic.co/t/invalid-fieldreference/178721/3 "2019-04-29T19:14:17Z")

</div>

Hi  
Thank you very much for your response and sorry for late response. Your solution worked perfectly. I am guessing the documentation is not updated for latest version.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2019, 7:14pm UTC](https://discuss.elastic.co/t/invalid-fieldreference/178721/4 "2019-05-27T19:14:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
