# Problem with "split" and "add\_field" in mutate filter
**URL:** https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883
**Category:** Logstash
**Created:** [November 21, 2019, 12:15pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883 "2019-11-21T12:15:19Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@zebu14](https://discuss.elastic.co/u/zebu14)
#### Post date: [November 21, 2019, 12:15pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/1 "2019-11-21T12:15:19Z")
Hello,
I have the following log line :
> "1","O","I","191118 190923","E","0","1455","SFTP","PNVIO111","IT9","/data/files/TRANS","FOPIT901-9281025"
And the following dissect filter :
> dissect {
> mapping =\> {
> "message" =\> '"%{type}","%{direction}","%{mode}","%{date}","%{status}","%{code}","%{size}","%{protocol}","%{src}","%{dst}","%{path}","%{file\_component}"'
> }
My final goal is to split the last field "file\_component" into two new fields ("shortidf" and "trans\_id"), based on the "-" splitting char.
So I wrote thess mutate filters (based on the doc example here [Mutate filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order)) :
> mutate {
> copy =\> { "file\_component" =\> "idf" }
> }
```
mutate {
split => ["idf", "-"]
add_field => { "shortidf" => "%{idf[0]}" }
}
```
The "copy" is OK (I obtain a field called "idf" in my json output)
the "split" is OK (if I comment the _add\_field_ part), I obtain :
> "file\_component" =\> "FOPIT901-9281025",
> "idf" =\> [
> [0] "FOPIT901",
> [1] "9281025"
> ],
But the _add\_field =\> { "shortidf" =\> "%{idf[0]}" }_ part gives me an error on logstash output if I activate it in the mutate filter :
> org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `idf[0]`
Any idea on what I'm doing wrong ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 21, 2019, 1:45pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/2 "2019-11-21T13:45:20Z")
> [@zebu14](#):
>
> idf[0]
Use [idf][0]
---
### Author:  [@zebu14](https://discuss.elastic.co/u/zebu14)
#### Post date: [November 21, 2019, 2:15pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/3 "2019-11-21T14:15:39Z")
Great ! thank you.
It's ok now.
What have I missed ? on the documentation, it's clearly wrote as this :
add\_field =\> { "shortHostname" =\> "%{hostname[0]}" }
If I can abuse of your help, what would be the best method to split the field shortidf, containing "FOPIT901" into two fields containing :
"source" = 3 first chars of the shortidf field (FOP)
"target" = 3 next chars (IT9)
Any idea ?
The split method uses a separator (but there isn't here)
The truncate method uses a length\_bytes but it's not possible to truncate into multiple fields ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 21, 2019, 2:24pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/4 "2019-11-21T14:24:07Z")
> [@zebu14](#):
>
> What have I missed ?
In older releases that would work, but recently the code was change to disallow ambiguous field references like hostname[0]. Sadly the documentation has not been updated to reflect that.
You can use mutate+gsub to capture fixed length substrings.
```
mutate { copy => { "shortidf" => "source" "shortidf" => "target" } }
mutate {
gsub => [
"source", "^(.{3}).*", "\1",
"target", "^.{3}(.{3}).*", "\1"
]
}
```
---
### Author:  [@zebu14](https://discuss.elastic.co/u/zebu14)
#### Post date: [November 21, 2019, 2:26pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/5 "2019-11-21T14:26:03Z")
Wow, really impressed...
Thanks for your precious help.
Regards,
Xavier
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 19, 2019, 2:26pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/6 "2019-12-19T14:26:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.