logstash怎么对切割过的字段再次切割

"message" => "{\"http_host\": \"api.xxxx.com\", \"time_local\": \"08/May/2018:17:21:46 +0800\", \"remote_addr\": \"10.0.0.23\", \"remote_user\": \"-\", \"request\": \"GET /user/info?_time=1525771301408&access_token=xxxx-xxxx-xxxx-xxx-xxxxxxx&sign=xxxxxxxx_user_id=&_version=4.1.0&os=ios HTTP/1.1\", \"status\": \"200\", \"body_bytes_sent\": \"350\", \"http_referrer\": \"-\", \"http_user_agent\": \"%E6%8A%95%E9%A1%BE%E5%A4%A7%E5%B8%88/70815 CFNetwork/887 Darwin/17.0.0\", \"http_x_forwarded_for\": \"xx.xx.xx.xx, 10.255.0.4\", \"request_time\": \"0.005\", \"upstream_response_time\": \"0.005\"} "

}

"request" => [

        [0] "GET",

        [1] "/user/info?_time=1525771301408&access_token=xxxxxx-xxxx-xxxx-xxxx-xxxxx&sign=xxxxxxxxxxxx&_user_id=&_version=4.1.0&os=ios",

        [2] "HTTP/1.1"

    ],

"request_method" => "GET"

"request_uri" => "/user/info?_time=1525771301408&access_token=xxxxx-xxxx-xxxx-xxxx-xxxxxx&sign=xxxxxxxxxxxx&_user_id=&_version=4.1.0&os=ios",

"http_version" => "HTTP/1.1"

mutate {

        split => ["request"," "]

        add_field => ["request_method","%{request[0]}"]

        add_field => ["request_uri","%{request[1]}"]

        add_field => ["http_version","%{request[2]}"]

mutate {

        split => ["request"," "]

        add_field => ["request_method","%{request[0]}"]

        add_field => ["request_uri","%{request[1]}"]

        add_field => ["http_version","%{request[2]}"]

        

        split => ["request_uri","?"]

        add_field => ["request_action","%{request_uri[0]}"]

        add_field => ["request_parameter","%{request_uri[1]}"]

"request_action" => "%{request_uri[0]}",

"request_parameter" => "%{request_uri[1]}",