Warning about ambiguous (mutate filter + split)

[dooger21 (David)]

Hi everyone,

I have a Log that I read using the file plugin and the multiline codec (so far so good), I separate the columns that I want to get using a mutate and split in the filter, however in the execution of my .conf I see warnings that refer ambiguity in the fields (2). Please your help, what should I change in my code to avoid these warnings?

The warnings in text:
[2020-09-16T16:09:09,410][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference message[0], which we expanded to the path [message, 0]; in a future release of Logstash, ambiguous Field References will not be expanded.
[2020-09-16T16:09:09,414][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference message[2], which we expanded to the path [message, 2]; in a future release of Logstash, ambiguous Field References will not be expanded.
[2020-09-16T16:09:09,460][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference message[4], which we expanded to the path [message, 4]; in a future release of Logstash, ambiguous Field References will not be expanded.
[2020-09-16T16:09:09,460][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference message[6], which we expanded to the path [message, 6]; in a future release of Logstash, ambiguous Field References will not be expanded.

[Badger]

Please do not pictures of text. They are hard to read and impossible to search. Just post the text.

[leandrojmp (Leandro Pereira)]

You should access the index of the message field after the split filter using [message][index], but you are using message[index], this is probably the reason of your warning.

Change your pipeline to use [message][index] instead of message[index].

[dooger21 (David)]

Its ok. Thanks @leandrojmp