I have a field X that has the value fw.auth.deny or fw.auth.allow How can I create a new field that is called y that has the value fw in it using logstash or mapping templates? Thanks in advance. Chris P.S. I looked around a lot and could not find an example of how to do this.

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

On ingest I need to create a new field based on the value of a field in the document