# Logstash mutate error for hostname

**URL:** https://discuss.elastic.co/t/logstash-mutate-error-for-hostname/257474
**Category:** Logstash
**Created:** [December 3, 2020, 9:02am UTC](https://discuss.elastic.co/t/logstash-mutate-error-for-hostname/257474 "2020-12-03T09:02:53Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![aaron111com](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@aaron111com](https://discuss.elastic.co/u/aaron111com)
#### Post date: [December 3, 2020, 9:02am UTC](https://discuss.elastic.co/t/logstash-mutate-error-for-hostname/257474/1 "2020-12-03T09:02:54Z")

</div>

hi I meet a weird problem, I want to parse my hostname is "alexworkstation-alex", I wanna get the string "alexworkstation" , so I split the hostname by "-" . but I can't add\_field .

this is follow with official doc: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)

```auto

my logstash.yml is :
input {
  beats {
    port => 5044
  }
}
filter {
  mutate {
    split => { "hlexname" => "-" }
    add_field => { "shortHostname" => "%{hlexname[0]}" }
  }
}
output {
        stdout { }
}

This is the output:

{
      "@version" => "1",
           "log" => {
          "file" => {
            "path" => "/workspace/log/alex.log"
        },
        "offset" => 261
    },
           "ecs" => {
        "version" => "1.5.0"
    },
      "hlexname" => [
        [0] "alexworkstation",
        [1] "alex"
    ],
          "tags" => [
        [0] "beats_input_codec_plain_applied",
        [1] "_mutate_error"
    ],
    "@timestamp" => 2020-12-03T08:47:31.030Z,
         "agent" => {
                "type" => "filebeat",
                  "id" => "ba946663-8b33-4cdc-9b16-ac1384ebcaee",
        "ephemeral_id" => "50cbd2de-89f2-4b57-bfa9-8b56d154c818",
             "version" => "7.7.1",
            "hostname" => "alexworkstation-alex"
    },
         "input" => {
        "type" => "log"
    },
       "message" => "Thu Dec 3 08:47:24 UTC 2020",
          "host" => {
        "name" => "alexworkstation-alex"
    }
}

```

---

<div class="post-metadata">

### Author: ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)
#### Post date: [December 3, 2020, 9:51am UTC](https://discuss.elastic.co/t/logstash-mutate-error-for-hostname/257474/2 "2020-12-03T09:51:37Z")

</div>

rather :

```
filter {
  mutate {
    split => ["hlexname", "-"]
    add_field => { "shortHostname" => "%{hlexname[0]}" }
  }
}
```

---

<div class="post-metadata">

### Author: ![aaron111com](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@aaron111com](https://discuss.elastic.co/u/aaron111com)
#### Post date: [December 3, 2020, 9:56am UTC](https://discuss.elastic.co/t/logstash-mutate-error-for-hostname/257474/3 "2020-12-03T09:56:35Z")

</div>

tried. Doesn't work. keep mutate error

---

<div class="post-metadata">

### Author: ![aaron111com](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@aaron111com](https://discuss.elastic.co/u/aaron111com)
#### Post date: [December 3, 2020, 10:02am UTC](https://discuss.elastic.co/t/logstash-mutate-error-for-hostname/257474/4 "2020-12-03T10:02:15Z")

</div>

I fixed myself with add\_field =\> { "shortHostname" =\> "%{[hlexname][0]}" }

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 31, 2020, 10:02am UTC](https://discuss.elastic.co/t/logstash-mutate-error-for-hostname/257474/5 "2020-12-31T10:02:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.