# Split hostname into new fields

**URL:** <https://discuss.elastic.co/t/split-hostname-into-new-fields/375022>\
**Category:** Logstash\
**Created:** [February 25, 2025, 2:14pm UTC](https://discuss.elastic.co/t/split-hostname-into-new-fields/375022 "2025-02-25T14:14:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gowtham1](https://avatars.discourse-cdn.com/v4/letter/g/4da419/32.png) [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\
**Post date:** [February 25, 2025, 2:14pm UTC](https://discuss.elastic.co/t/split-hostname-into-new-fields/375022/1 "2025-02-25T14:14:06Z")

</div>

Hi,  
I'm new to Logstash,I'm trying to split the hostname into new fields like the below example  
hostname = gbldi-f01-switch split to the below fields  
SITE\_ID = gbldi  
FLOOR = f01  
CATEGORY = switch

Please see the below logstash conf and how to fix this?  
mutate {  
copy =\> {  
"[host][shortname]" =\> "SITE\_CODE"  
}  
}  
mutate {  
split =\> ["SITE\_CODE", "-"]   
}  
mutate {  
replace =\> ["SITE\_CODE", "%{[host][shortname][0]}"]  
}  
mutate {  
add\_field =\> { "FLOOR" =\> "%{[host][shortname]}" }  
}  
mutate {   
split =\> ["FLOOR", "-"]  
}  
mutate {   
replace =\> ["FLOOR", "%{[host][shortname][1]}"]   
}

Thanks  
Gowtham

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 25, 2025, 2:51pm UTC](https://discuss.elastic.co/t/split-hostname-into-new-fields/375022/2 "2025-02-25T14:51:18Z")

</div>

Try

```
    mutate { add_field => { "[@metadata][hostname]" => "%{[host][shortname]}" } }
    mutate {
        split => { "[@metadata][hostname]" => "-" }
        add_field => {
            "SITE_ID" => "%{[@metadata][hostname][0]}"
            "FLOOR" => "%{[@metadata][hostname][1]}"
            "CATEGORY" => "%{[@metadata][hostname][2]}"
        }
    }

```

---

<div class="post-metadata">

**Author:** ![Gowtham1](https://avatars.discourse-cdn.com/v4/letter/g/4da419/32.png) [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\
**Post date:** [February 25, 2025, 3:41pm UTC](https://discuss.elastic.co/t/split-hostname-into-new-fields/375022/3 "2025-02-25T15:41:02Z")

</div>

Hi Badger,

Thanks for your prompt response. Let me try and update the status.

Thanks  
Gowtham

---

<div class="post-metadata">

**Author:** ![Gowtham1](https://avatars.discourse-cdn.com/v4/letter/g/4da419/32.png) [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\
**Post date:** [February 25, 2025, 5:07pm UTC](https://discuss.elastic.co/t/split-hostname-into-new-fields/375022/4 "2025-02-25T17:07:54Z")

</div>

Hi Badger,

Thanks for your update and it's working as expected.

Thanks  
Gowtham S