Issues procesing fields with mutate

Elastic Stack Logstash
1

Hello,
Im having a hard time trying to do some simple task, copy a field to another name, split the value, and add a new field using one of the splited part. (Hope to give you some background with this)
In other words my scenario is kind of the following example of the Logstash documentation

filter {
  mutate {
    split => ["hostname", "."]
    add_field => { "shortHostname" => "%{hostname[0]}" }
  }

mutate {
    rename => ["shortHostname", "hostname" ]
  }
}

But I cant make it to work in my logstash stanza that is this one

...
mutate {
  copy  => ["[data][device][extended][olt]","olt_tmp"]
}

mutate {
  split => ["olt_tmp", "-"]
  add_field => { "oltbasename" => "%{olt_tmp[0]}" }
 }
...

With this code snipet Im geting this error while ingesting data

[2019-07-24T18:48:24,475][ERROR][org.logstash.execution.WorkerLoop] Exception in 
pipelineworker, the pipeline stopped processing new events, please check your filter 
configuration and restart Logstash.
org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `olt_tmp[0]`

And of course if I comment the add_field sentence (that is the one that make the whole logstash crash). I get the olt_tmp field created and splited correclty just like this

"olt_tmp" : [
"XXXXGP01",
"XXXBLOCK4"
]

Please I can't see what Im doing wrong in here, thanks in advance

2

I suspect this is no longer supported and should be

"%{[hostname][0]}"
1 Like
3

Yes I figured it out a few mins after I post it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.