I was browsing mutate -> split documentation and example is messed up, took me a while to find the solution what was wrong.
Deprecated doc link:
https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split
Example:
filter {
mutate {
split => ["hostname", "."]
add_field => { "shortHostname" => "%{hostname[0]}" }
}
...
}
This does not work and throws: Invalid FieldReference: hostname[0]
" in Logstash 7.3.0
The snippet that worked for me is:
filter {
mutate {
split => ["hostname", "."]
add_field => { "shortHostname" => "%{[hostname][0]}" }
}
...
}