split add_field throws after logstash upgrade from 6.5 to 6.8.8

[vijaykaali811]

in test 7.x following working fine
mutate { split => [ "shorthost2", "." ] }
mutate { add_field => { "shorthost22" => "%{[shorthost2][0]}" } }

in production i have upgrade to 6.8 but following is not working
mutate {
split => [ "shorthost2", "." ]
}
mutate { add_field => { "shorthost1" => "%{[shorthost2][0]}" } }
and previous setting also not working
mutate {
split => [ "shorthost2", "." ]
add_field => { "shorthost1" => "%{shorthost2[0]}" }
}

Surprisingly , in both 6.5 & 6.8 for system metricbeat beat.hostname following is working
mutate {
split => [ "shorthost2", "." ]
add_field => { "shorthost1" => "%{shorthost2[0]}" }
}

only for data which comes from our custom script python script for rhel 5 . is not working
if i remove add_field => { "shorthost1" => "%{shorthost2[0]}" } all is fine but i am not able to hostname withfqdn in another field . tried all combination but still new shorthost1 have %{[pythonbeat][Hostname]} as value .

can you help on this