Split not splitting?

Elastic Stack Logstash
1

We want to split a URL into it's path components and apply some logic based on parts of the URL.

Filter:

mutate {
    copy => {"url" => "path"}
    split => {"path" => "/"}
}

Result:

{
...
     "url" => "/foo/bar/20771042",
     "path" => "/foo/bar/20771042",
...
}

We were expecting an array but path looks (in LogStash console and Kibana) to be a simple string.

Using split => ["path", "/"] or split => {"path" => "\/"} makes no difference.

Shouldn't path become an array like ["foo", "bar", ...]?

2
3

Yep, splitting the mutate solves the non-splitting split!

mutate { copy => {"url" => "path"} }
mutate { split => {"path" => "/"} }

Result:

"path" => [
    [0] "",
    [1] "bcpstorefront",
    [2] "otherlink2"
]

Bonus Question: Any neat way to remove the empty ``[0] "" entry?

4

Gottit!

mutate { remove_field => ["path[0]"] }