Strip part of message Logstash

Elastic Stack Logstash
1

Hi,
I am trying to strip part of message, with below configuration but getting mutate error, could you please check what I am doing wrong.

Message
[<XXX.XX.XX.XX>:<XXXX> <YYYY.YY.YY.YY>:<YYYY>,<XXX.XX.XX.XX>:<XXXX> <YYYY.YY.YY.YY>:<YYYY>]

since the same IP's are logging two times i am stripping the second part after ','

  mutate { 
    replace => { "type" => "sm_access" } 
    split => ["AuthDirserver", ","]
    add_field => { "AuthDirServer_1" => "%{AuthDirserver[0]}" }
  }
  mutate { 
    rename => ["AuthDirServer_1", "AuthDirServer" ]
  }

Error Message

   "AuthDirserver" => [
    [0] "<XXX.XX.XX.XX>:<XXXX> <YYYY.YY.YY.YY>:<YYYY>",
    [1] "<XXX.XX.XX.XX>:<XXXX> <YYYY.YY.YY.YY>:<YYYY>"
],
            "tags" => [
    [0] "_mutate_error"
],
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.