Add_field order of execution


(Dan Markhasin) #1

I've noticed that the add_field operation is executed last - this is not explicitly documented and causes unexpected behavior when doing something like:

mutate
{
add_field => {"target" => "foo"}
add_field => {"[@metadata][source]" => "bar"}
copy => {"[@metadata][source]" => "target"}
}

The result is "target" => "foo" rather than the expected "bar".

Is there any way to change this behavior?


(Magnus B├Ąck) #2

I've noticed that the add_field operation is executed last - this is not explicitly documented

No, I guess not. The add_field docs say "If this filter is successful, add any arbitrary fields to this event" which implies that it executes last.

Is there any way to change this behavior?

No. Do not rely on the execution order of the options listed in a mutate filter. If there are dependencies between them you need to use multiple mutate filters.


#3

In addition to decoration being executed last, the order of the mutate specific functions is also fixed, as you will see if you check the source...


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.