# Mutate Split unable to get variables **URL:** \ **Category:** Logstash\ **Created:** [March 7, 2019, 6:38pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372 "2019-03-07T18:38:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Post date:** [March 7, 2019, 6:38pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372/1 "2019-03-07T18:38:41Z")
Logstash version 6.6.1 I am attempting to split out the [path] to get the file name. Not all of my logs have extensions, so I am attempting to split things by the / rather than the grok example that I found with the ".log" at the end. But I have been unable to get even basic split functionality working. Here is my dmesg.conf: ```auto input { pipeline { address => dmesg_log } } filter { mutate { split => ["path", "/"] } mutate { add_field => { "shortHostname" => "%{path[-1]}" } } } ``` When I run this through logstash I receive a warning: ```auto [2019-03-07T09:08:41,478][WARN][org.logstash.FieldReference] Detected ambiguous Field Reference `path[-1]`, which we expanded to the path `[path, -1]`; in a future release of Logstash, ambiguous Field References will not be expanded. ``` When I check the output, I find that logstash creates the shortHostname and sets it to "%{path[-1]}" ```auto {"shortHostname":"%{path[-1]}","tags":["beats_input_codec_plain_applied"],"host":{"id":"e815db59563c4267b2ffb999d0cabc42","containerized":tr ue,"os":{"family":"redhat","version":"7 (Core)","platform":"centos","codename":"Core","name":"CentOS Linux"},"architecture":"x86_64","name": "localhost.localdomain"},"@version":"1","source":"/var/log/dmesg","prospector":{"type":"log"},"fields":{"dmesg":true},"message":"[6.6199 73] type=1305 audit(1551742248.385:4): audit_pid=567 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1","input": {"type":"log"},"log":{"file":{"path":"/var/log/dmesg"}},"beat":{"version":"6.6.1","hostname":"localhost.localdomain","name":"localhost.local domain"},"offset":120579,"@timestamp":"2019-03-07T17:08:42.061Z"} ``` From there, I opted to copy and paste the code snippet directly from the documentation to verify that I didn't have any major issues with my syntax. But I ran into the exact same problem: ```auto input { pipeline { address => dmesg_log } } filter { mutate { split => ["hostname", "."] add_field => { "shortHostname" => "{%hostname[0]}" } } } ``` When I run this, I don't receive any errors or warning but I have the same output issue: ```auto {"shortHostname":"{%hostname[0]}","tags":["beats_input_codec_plain_applied"],"host":{"id":"e815db59563c4267b2ffb999d0cabc42","containerized" :true,"os":{"family":"redhat","version":"7 (Core)","platform":"centos","codename":"Core","name":"CentOS Linux"},"architecture":"x86_64","nam e":"localhost.localdomain"},"@version":"1","source":"/var/log/dmesg","prospector":{"type":"log"},"fields":{"dmesg":true},"message":"[6.6 19973] type=1305 audit(1551742248.385:4): audit_pid=567 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1","inpu t":{"type":"log"},"log":{"file":{"path":"/var/log/dmesg"}},"beat":{"version":"6.6.1","hostname":"localhost.localdomain","name":"localhost.lo caldomain"},"offset":120579,"@timestamp":"2019-03-07T17:29:14.679Z ``` I am unsure what it is that I am doing wrong, especially when I am copying and pasting directly from the documentation. I'm not sure if the split is actually happening, or if I need to use variables a different way. Do you have any suggestions? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 7, 2019, 6:55pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372/2 "2019-03-07T18:55:58Z")
``` add_field => { "shortHostname" => "%{[path][-1]}" } ``` I did not know you could do an array reference like that, but it works! Which documentation did you copy and paste from? ---
**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Post date:** [March 7, 2019, 7:01pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372/3 "2019-03-07T19:01:28Z")
This was the documentation that I pulled it from: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split) And how did you get yours to work? When I used your example I still have the same problem ```auto {"shortHostname":"%{[path][-1]}","tags":["beats_input_codec_plain_applied"],"host":{"id":"e815db59563c4267b2ffb999d0cabc42","containerized": true,"os":{"family":"redhat","version":"7 (Core)","platform":"centos","codename":"Core","name":"CentOS Linux"},"architecture":"x86_64","name ":"localhost.localdomain"},"@version":"1","source":"/var/log/dmesg","prospector":{"type":"log"},"fields":{"dmesg":true},"message":"[6.61 9973] type=1305 audit(1551742248.385:4): audit_pid=567 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1","input ":{"type":"log"},"log":{"file":{"path":"/var/log/dmesg"}},"beat":{"version":"6.6.1","hostname":"localhost.localdomain","name":"localhost.loc aldomain"},"offset":120579,"@timestamp":"2019-03-07T19:00:01.479Z"} ``` Here is my dmesg.conf: ```auto filter { mutate { split => ["path", "/"] add_field => { "shortHostname" => "%{[path][-1]}" } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 7, 2019, 7:51pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372/4 "2019-03-07T19:51:33Z")
That event does not have a field [path], it has [log][file][path]. Try ``` split => ["[log][file][path]", "/"] add_field => { "shortHostname" => "%{[log][file][path][-1]}" } ``` ---
**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Post date:** [March 7, 2019, 7:58pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372/5 "2019-03-07T19:58:04Z")
Dangit, the farthest I went was [file][path] I didn't try [log][file][path]. That fixed my problem. Once again, thank you for your help with this. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2019, 7:58pm UTC](https://discuss.elastic.co/t/mutate-split-unable-to-get-variables/171372/6 "2019-04-04T19:58:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.