I think it would be possible by split:
mutate{
split => {"message" => "|"}
}
Output is now:
[0] Field1
[1] Field2
[2] Field3
and so on
If I try to add [1] into a field I got grokparsefailure
add_field => [ "received_from", "%{message}[3]" ]
What's wrong?