title: Logstash Joining Field values in certain order after split.
body: <p>I am trying to parse appache accesslogs with logstash for a project. </p>
  
  <p>To let elasticsearch search efficiënt I want to reverse the domainname.
  So for example:</p>
  
  <p>www.example.com Becomes com.example.www</p>
  
  <p>I tried to split the domainname and reverse that using the logstash mutate plugin. When parsed as is I get a field </p>
  
  <ul>
  <li>domainname : "www.example.com"</li>
  </ul>
  
  <p>Using settings below I get the following results:</p>
  
  <p>Setting:</p>
  
  <pre><code> mutate{
          split =&gt; {"domainname" =&gt; "."}
          add_field =&gt; {"reversed_domainname" =&gt; ["%{[domainname][-1]}","%{[domainname][-2]}"]}
          join =&gt; {"reversed_domainname" =&gt; "."}
  }
  </code></pre>
  
  <p>Result: </p>
  
  <p>domainname = [ "www", "example", "com" ]</p>
  
  <p>reversed_domainname =[ "com", "example" ]</p>
  
  <p>Everything works as intended untill the join function as seen in the results i dont get <em>com.example</em></p>
  
  <p>If I remove reversed from the join (split the domainname on "." and join them with "."  I get the same results. </p>
  
  <p>www.example.com becomes www.example.com</p>
  
  <p>How can I join the fields in reversed order as it clearly should work.</p>