Split hostname into new fields

Elastic Stack Logstash
1

Hi,
I'm new to Logstash,I'm trying to split the hostname into new fields like the below example
hostname = gbldi-f01-switch split to the below fields
SITE_ID = gbldi
FLOOR = f01
CATEGORY = switch

Please see the below logstash conf and how to fix this?
mutate {
copy => {
"[host][shortname]" => "SITE_CODE"
}
}
mutate {
split => [ "SITE_CODE", "-" ]
}
mutate {
replace => ["SITE_CODE", "%{[host][shortname][0]}"]
}
mutate {
add_field => { "FLOOR" => "%{[host][shortname]}" }
}
mutate {
split => ["FLOOR", "-"]
}
mutate {
replace => ["FLOOR", "%{[host][shortname][1]}"]
}

Thanks
Gowtham

2

Try

    mutate { add_field => { "[@metadata][hostname]" => "%{[host][shortname]}" } }
    mutate {
        split => { "[@metadata][hostname]" => "-" }
        add_field => {
            "SITE_ID" => "%{[@metadata][hostname][0]}"
            "FLOOR" => "%{[@metadata][hostname][1]}"
            "CATEGORY" => "%{[@metadata][hostname][2]}"
        }
    }
2 Likes
3

Hi Badger,

Thanks for your prompt response. Let me try and update the status.

Thanks
Gowtham

4

Hi Badger,

Thanks for your update and it's working as expected.

Thanks
Gowtham S