Logstash.filters.mutate

Elastic Stack Logstash
1

Hi
I'm facing the problem with filters.mutate

[2022-03-31T17:49:26,980][WARN ][logstash.filters.mutate ][subscriberstrunk][11ac345049d68c6fc55061d82c036ef3c26cf4e2fe68230c4df255bc3403de66] Exception caught while applying mutate filter {:exception=>"Invalid FieldReference: %{[data][1]}"}

I'm using below code

  mutate {
    split => [ "data", "::" ]
    add_field => {"tmp" => "%{[data][1]}" }
  }

What's wrong?

2

Hello,

Please share an example of your message so people can try to reproduce what you are doing.

3

Hi sure this is sample date :

dn: uid=8626270,ou=subscriberstrunkmembers,ou=subscriberstrunk,ou=sdr,o=ool
uid: 8626270
serviceId: T10065990

dn: uid=T10065903,ou=subscriberstrunk,ou=sdr,o=ool.com.pl
uid: T10065903
serviceId: T10065903
brand: 11

dn: uid=T10065914,ou=subscriberstrunk,ou=sdr,o=ool.com.pl
uid: T10065914
serviceId: T10065914
brand: 11

dn: uid=847537,ou=subscriberstrunk,ou=sdr,o=ool.com.pl
uid: 847537
serviceId: 847537
brand: 11

dn: uid=847538,ou=subscriberstrunk,ou=sdr,o=ool.com.pl
uid: 847538
serviceId: 847538
brand: 11

dn: uid=847536,ou=subscriberstrunk,ou=sdr,o=ool.com.pl
uid: 847536
serviceId: 8475
4

You need to provide more information.

Please share your full pipeline, it is not possible to understand what is happening without context.

Your mutate error means that logstash is trying to access the data field as it is an array, and get the second element, but this second element does not exist, which could mean that the data field is not an array.

But you need to share your full pipeline to show how you are creating this data field.

5

Also, which version of logstash?

6

this was build on for old version of logstash 7.2.0

7

and link to pipeline

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.