Please update your Logstash mutate split documentation example

I was browsing mutate -> split documentation and example is messed up, took me a while to find the solution what was wrong.

Deprecated doc link:
https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split

Example:

filter {
    mutate {
        split => ["hostname", "."]
        add_field => { "shortHostname" => "%{hostname[0]}" }
    }
...
}

This does not work and throws: Invalid FieldReference: hostname[0]" in Logstash 7.3.0

The snippet that worked for me is:

filter {
    mutate {
        split => ["hostname", "."]
        add_field => { "shortHostname" => "%{[hostname][0]}" }
    }
...
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.