# Append an array element to logs coming from Logstash

**URL:** <https://discuss.elastic.co/t/append-an-array-element-to-logs-coming-from-logstash/306794>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [June 9, 2022, 12:27pm UTC](https://discuss.elastic.co/t/append-an-array-element-to-logs-coming-from-logstash/306794 "2022-06-09T12:27:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dishant.sharma](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\
**Post date:** [June 9, 2022, 12:27pm UTC](https://discuss.elastic.co/t/append-an-array-element-to-logs-coming-from-logstash/306794/1 "2022-06-09T12:27:19Z")

</div>

how to append an element to a particular field already containing an array? Actually, I am writing a painless script in the output part of the Logstash conf file. Code inside my conf file is:

```auto
input {
    kafka {
        bootstrap_servers => "http://kafka:9092"
        topics => "elasticIndexUpdateTopic"
        codec => json {}
    }
}

filter {
    mutate {
        remove_field => ["@timestamp", "@version"]
    }
}

output {
    if ([isAppend] or [isAppend] == "true") {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      index => "su-test"
      document_id => "%{[id]}"
      action => "update"
      doc_as_upsert => true 
      script_lang => "painless"
      script => "for(item in params.event.get('%{[field]}')){if(!ctx._source.%{[field]}.contains(item)){ctx._source.%{[field]}.add(item)}}"
      }
    }
    else {
      elasticsearch {
        hosts => ["http://elasticsearch:9200"]
        index => "su-test"
        document_id => "%{[id]}"
        action => "update"
        doc_as_upsert => true 
      }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2022, 12:28pm UTC](https://discuss.elastic.co/t/append-an-array-element-to-logs-coming-from-logstash/306794/2 "2022-07-07T12:28:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.