# Add an array using Mutate's add\_field

**URL:** <https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946>\
**Category:** Logstash\
**Created:** [September 25, 2019, 2:17am UTC](https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946 "2019-09-25T02:17:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)\
**Post date:** [September 25, 2019, 2:17am UTC](https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946/1 "2019-09-25T02:17:46Z")

</div>

Hi Guys,

I have a logstash pipeline where I am receiving a JSON file as HTTP input and forwarding it to output plugin.  
I want to introduce below structure to input JSON :

"parentField": {  
"field0": "value0",  
"arrayName": [  
{  
"field1": "value1",  
"field2": "value2"  
}  
]  
}

To achieve that I am trying to use below filter ::  
filter {  
mutate {  
add\_field =\> { "[parentField][field0]" =\> "value0" }  
add\_field =\> { "[parentField][arrayName][0][field1]" =\> "value1" }  
add\_field =\> { "[parentField][arrayName][0][field2]" =\> "value2" }  
}  
}

But in this case [0] gets translated to a literal "0" and is being treated as a key instead of array index.  
Meaning [parentField][arrayName][0][field1] gets translated to  
parentfield =\> arrayname =\> "0" =\> {"field1" =\> "value1", "field2" =\> "value2"}

What I am trying to achieve is  
parentfield =\> arrayname =\> [[0] "field1"=\>"value1", "field2" =\> "value2"]

How do I add an array of fields using mutate's add\_filter?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 25, 2019, 1:23pm UTC](https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946/2 "2019-09-25T13:23:05Z")

</div>

> [@buch11](#):
>
> How do I add an array of fields using mutate's add\_filter?

You can add an array of strings using

```
mutate { add_field => { "foo" => ["a", "b"] } }

```

I do not think you can add an array of hashes

---

<div class="post-metadata">

**Author:** ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)\
**Post date:** [September 25, 2019, 11:54pm UTC](https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946/3 "2019-09-25T23:54:32Z")

</div>

If I can not use mutate, is there any other way of achieving this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 26, 2019, 3:46pm UTC](https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946/4 "2019-09-26T15:46:52Z")

</div>

You can do pretty much anything with a ruby filter.

---

<div class="post-metadata">

**Author:** ![buch11](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@buch11](https://discuss.elastic.co/u/buch11)\
**Post date:** [October 1, 2019, 1:06am UTC](https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946/5 "2019-10-01T01:06:25Z")

</div>

cool, thanks!

I just found out that I can write plugins in java as well - [https://www.elastic.co/guide/en/logstash/current/contributing-java-plugin.html](https://www.elastic.co/guide/en/logstash/current/contributing-java-plugin.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2019, 1:06am UTC](https://discuss.elastic.co/t/add-an-array-using-mutates-add-field/200946/6 "2019-10-29T01:06:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.