I would like to incrementally set multivalue fields in a succession of processor statements.
What I want to do is analogous to a series of add_tags processors with various conditions; but I don't want to pollute the 'tags' namespace with facets local to a single service.
I can set multivalue fields with e.g.
- "that a way"
but successive statements of this nature overwrite, rather than amend, the field contents.
Searching on appending arrays in beats only gets me hits in logstash.
Am I out of luck? Am I silly to scruple at polluting the tags namespace? I really don't want to add tags like
... It seems icky.