Append values to array with filebeat processors

I would like to incrementally set multivalue fields in a succession of processor statements.

What I want to do is analogous to a series of add_tags processors with various conditions; but I don't want to pollute the 'tags' namespace with facets local to a single service.

I can set multivalue fields with e.g.

  • add_fields:
    target: 'foo"
    - "that a way"
    - "other"
    - "blahblah"

but successive statements of this nature overwrite, rather than amend, the field contents.

Searching on appending arrays in beats only gets me hits in logstash.

Am I out of luck? Am I silly to scruple at polluting the tags namespace? I really don't want to add tags like


... It seems icky.

Hi @rout39574, welcome to the Elastic community forums!

Unfortunately, this isn't possible today but this sounds like a useful feature. Would you mind filing a feature request via Perhaps the add_fields processor could take an append_array_values boolean setting or something like that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.