# Issues procesing fields with mutate
**URL:** https://discuss.elastic.co/t/issues-procesing-fields-with-mutate/192124
**Category:** Logstash
**Created:** [July 24, 2019, 7:31pm UTC](https://discuss.elastic.co/t/issues-procesing-fields-with-mutate/192124 "2019-07-24T19:31:28Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@humartinez](https://discuss.elastic.co/u/humartinez)
#### Post date: [July 24, 2019, 7:31pm UTC](https://discuss.elastic.co/t/issues-procesing-fields-with-mutate/192124/1 "2019-07-24T19:31:28Z")
Hello,
Im having a hard time trying to do some simple task, copy a field to another name, split the value, and add a new field using one of the splited part. (Hope to give you some background with this)
In other words my scenario is kind of the following example of the Logstash documentation
```
filter {
mutate {
split => ["hostname", "."]
add_field => { "shortHostname" => "%{hostname[0]}" }
}
mutate {
rename => ["shortHostname", "hostname"]
}
}
```
But I cant make it to work in my logstash stanza that is this one
```
...
mutate {
copy => ["[data][device][extended][olt]","olt_tmp"]
}
mutate {
split => ["olt_tmp", "-"]
add_field => { "oltbasename" => "%{olt_tmp[0]}" }
}
...
```
With this code snipet Im geting this error while ingesting data
```
[2019-07-24T18:48:24,475][ERROR][org.logstash.execution.WorkerLoop] Exception in
pipelineworker, the pipeline stopped processing new events, please check your filter
configuration and restart Logstash.
org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `olt_tmp[0]`
```
And of course if I comment the add\_field sentence (that is the one that make the whole logstash crash). I get the olt\_tmp field created and splited correclty just like this
```
"olt_tmp" : [
"XXXXGP01",
"XXXBLOCK4"
]
```
Please I can't see what Im doing wrong in here, thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 24, 2019, 8:08pm UTC](https://discuss.elastic.co/t/issues-procesing-fields-with-mutate/192124/2 "2019-07-24T20:08:59Z")
> [@humartinez](#):
>
> "%{hostname[0]}"
I suspect this is no longer supported and should be
```
"%{[hostname][0]}"
```
---
### Author:  [@humartinez](https://discuss.elastic.co/u/humartinez)
#### Post date: [July 24, 2019, 8:27pm UTC](https://discuss.elastic.co/t/issues-procesing-fields-with-mutate/192124/3 "2019-07-24T20:27:36Z")
Yes I figured it out a few mins after I post it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 21, 2019, 8:27pm UTC](https://discuss.elastic.co/t/issues-procesing-fields-with-mutate/192124/4 "2019-08-21T20:27:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.