# Problem with "split" and "add\_field" in mutate filter

**URL:** https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883
**Category:** Logstash
**Created:** [November 21, 2019, 12:15pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883 "2019-11-21T12:15:19Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 21, 2019, 2:24pm UTC](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/4 "2019-11-21T14:24:07Z")

</div>

> [@zebu14](#):
>
> What have I missed ?

In older releases that would work, but recently the code was change to disallow ambiguous field references like hostname[0]. Sadly the documentation has not been updated to reflect that.

You can use mutate+gsub to capture fixed length substrings.

```
mutate { copy => { "shortidf" => "source" "shortidf" => "target" } }
mutate {
    gsub => [
        "source", "^(.{3}).*", "\1",
        "target", "^.{3}(.{3}).*", "\1"
    ]
}

```

---

_[View the full topic](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883)._