Problem with "split" and "add_field" in mutate filter

Elastic Stack Logstash
4

In older releases that would work, but recently the code was change to disallow ambiguous field references like hostname[0]. Sadly the documentation has not been updated to reflect that.

You can use mutate+gsub to capture fixed length substrings.

mutate { copy => { "shortidf" => "source" "shortidf" => "target" } }
mutate {
    gsub => [
        "source", "^(.{3}).*", "\1",
        "target", "^.{3}(.{3}).*", "\1"
    ]
}