# Work on logstash 6.4.2 but not with 7.0.0

**URL:** https://discuss.elastic.co/t/work-on-logstash-6-4-2-but-not-with-7-0-0/180916
**Category:** Logstash
**Created:** [May 14, 2019, 4:37am UTC](https://discuss.elastic.co/t/work-on-logstash-6-4-2-but-not-with-7-0-0/180916 "2019-05-14T04:37:20Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![heweixi](https://avatars.discourse-cdn.com/v4/letter/h/35a633/32.png) [@heweixi](https://discuss.elastic.co/u/heweixi)
#### Post date: [May 14, 2019, 4:37am UTC](https://discuss.elastic.co/t/work-on-logstash-6-4-2-but-not-with-7-0-0/180916/1 "2019-05-14T04:37:20Z")

</div>

on filter ,want to split and get a element from array  
but is not work on 7.0 and work with 6.4,6.5,code like:

mutate {  
split =\> ["message", " | "]  
add\_field =\> { "ip" =\> "%{message[0]}" }  
}

data as:  
elem1 | elem2 | elem3 | elem4

other, I also want to get array lenth and get last element

thanks very much!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 14, 2019, 1:43pm UTC](https://discuss.elastic.co/t/work-on-logstash-6-4-2-but-not-with-7-0-0/180916/2 "2019-05-14T13:43:36Z")

</div>

logstash no longer supports field references like message[0], it has to be [message][0]

```
add_field => {
    "ip" => "%{[message][0]}"
    "last" => "%{[message][-1]}"
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2019, 2:48am UTC](https://discuss.elastic.co/t/work-on-logstash-6-4-2-but-not-with-7-0-0/180916/4 "2019-06-12T02:48:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.