Elastic's Logstash Mutate Split not working - elasticsearch

Question

I'm having trouble splitting the http.request.referrer field in logstash. This is coming from packet beat. I want to only use the domain and not the full path. With the following filter, as suggested here https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html, I get the following error
[WARN ][logstash.filters.mutate ] Exception caught while applying mutate filter {:exception=>"Invalid FieldReference: `sfa[2]`"}
But if I dont try to retrieve the second element and just used the field sfa to add to sfa_ref then it works, only with the forward slashes replaced by commas.
filter {
mutate {
add_field => {"sfa" => "%{[http][request][referrer]}"}
}
mutate {
split => ["sfa", "/"]
add_field => {"sfa_ref" => "%{sfa[2]}"}
}
}
input is as follows:
{
"http": {
"request": {
"bytes": 727,
"method": "get",
"headers": {
"content-length": 0
},
"referrer": "https://example.domain.com/web/font-awesome/css/font-awesome.min.css"
},
"response": {
"bytes": 66989,
"status_code": 200,
"body": {
"bytes": 66624
},
"headers": {
"content-length": 66624,
"content-type": "application/font-woff2"
}
},
"version": "1.1"
},
"status": "OK"
}
After the split,the sfa field becomes:
"sfa": [ "https:", "", "example.domain.com", "web", "font-awesome", "css", "font-awesome.min.css" ]

Answer 1

The documentation followed seems to be outdated. In the newer versions of logstash, the proper way to address an array or elements in them is %{[field_name][index]}.
So I needed square brackects around the field name also.
mutate {
split => ["sfa", "/"]
add_field => {"sfa_ref" => "%{[sfa][2]}"}
}