logstash-plugins/logstash-filter-mutate

Wrong split example in official documents

Opened this issue · 1 comments

link:https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split

Example:

filter {
    mutate {
        split => ["hostname", "."]
        add_field => { "shortHostname" => "%{hostname[0]}" }
    }

    mutate {
        rename => ["shortHostname", "hostname" ]
    }
}

In this example,split's input type is a list,But it must a hash

I'd like to add that older documentation is incorrect.

Per 6.5 documentation, split takes a hash

filter {
  mutate {
     split => { "fieldname" => "," }
  }
}

this is incorrect and throws a logstash error. It takes a list as input

filter {
  mutate {
     split => [ "fieldname", "," ]
  }
}