title: Logstash - using mutate with split
body: <p>I'm trying to use the <em>mutate</em> filter with the <em>split</em> method, to extract a part of a field retrieved by the json filter. But I didn't find how to exploit the result of the split.
  Here's my <em>logical</em> configuration (only the simple json part works well):</p>
  
  <pre><code>filter {
          if [type] == "phperrors" {
                  json {
                          source =&gt; "message"
                          target =&gt; "phperror_log"
                          remove_field =&gt; "message"
                          add_tag =&gt; [ "php", "error" ]
                  }
                  mutate {
                          split =&gt; ["[phperror_log][server]", "."]
                          #if [phperror_log][server][1] {
                                  add_field =&gt; [ "pop", "%{[phperror_log][server][1]}" ]
                          #}
                  }
          }
  }
  </code></pre>
  
  <p>As I said the json part works well and the phperror_log.server field exists (and the value is something like node01.ny or node01.par or node02).</p>
  
  <p>But all I want is to create a new field if the split create an array of 2 fields and I suppose I'm not doing the right thing with my [phperror_log][server][1].</p>
  
  <p>Have you any clues, advices or best practices to resolve this kind of use case?</p>
  
  <p>Thanks in advance</p>
  
  <p>edit: I edit with a conf that should work with the split... however the if is not ok</p>
  
  <p>last edit with a nice conf according to the tips and advices from Alain:</p>
  
  <pre><code>filter {
          if [type] == "phperrors" {
                  json {
                          source =&gt; "message"
                          target =&gt; "phperror_log"
                          remove_field =&gt; "message"
                          add_tag =&gt; [ "php", "error" ]
                  }
                  if [phperror_log][server] =~ /\./ {
                          mutate {
                                  split =&gt; ["[phperror_log][server]", "."]
                                  add_field =&gt; [ "pop", "%{[phperror_log][server][1]}" ]
                                  add_field =&gt; [ "errorhost", "%{[phperror_log][server][0]}" ]
                          }
                  } else {
                          mutate {
                                  add_field =&gt; [ "pop", "not defined" ]
                                  add_field =&gt; [ "errorhost", "%{[phperror_log][server]}" ]
                          }
                  }
                  mutate {
                          remove_field =&gt; [ "[phperror_log][server]" ]
                  }
          }
  }
  </code></pre>