Invalid FieldReference in array crashes Logstash

[Aketzu]

• Version: Logstash 7.0.0
• Operating System: Linux Debian

I have following in a Logstash pipeline:

filter {
  mutate {
    id => "rename_fields"
    rename => { "770" => "gprs_operator" }
  }
  mutate {
    id => "parse_operator"
    split => { "gprs_operator" => "," }
    rename => { "gprs_operator[0]" => "gprs_operator_name" }
    rename => { "gprs_operator[0]" => "gprs_operator_number" }
    remove_field => [ "gprs_operator" ]
    strip => ["gprs_operator_name", "gprs_operator_number"]
  }
}

So basically it would parse incoming string "elisa, 24405" into name: "elisa", number: "24405". This used to work in previous Elastic versions (somewhere from 5.x to 6.7) and broke in 7.0.

I'm not sure which exact input triggers the problem but it might be empty or nonexistent param. This then triggers org.jruby.exceptions.RuntimeError: (RuntimeError) Invalid FieldReference: 'gprs_operator[0]' which in turn causes whole logstash to exit and restart. (And after a while read the same message again, parse, crash, restart...)

Full crash log in this snippet

[TheVastyDeep]

Logstash stopped allowing ambiguous field references in 7.x, you should change it to "[gprs_operator][0]". This is working as expected.