Mutate split not working as expected

Elastic Stack Logstash
1

Hi,
I am trying to split message by new new line
mutate {
copy => { "message" => "message_val" }
}

mutate {
split => { "message_val" => "\n" }
add_field => { "fullQuery" => "%{message_val[4]}" }
}

the output is coming like
%{message_val[4]}

Is there anything i am missing here?

2

i solved this with multiple gsub replacements

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.