Append values to array with filebeat processors

[rout39574 (Allen S. Rout)]

I would like to incrementally set multivalue fields in a succession of processor statements.

What I want to do is analogous to a series of add_tags processors with various conditions; but I don't want to pollute the 'tags' namespace with facets local to a single service.

I can set multivalue fields with e.g.

• add_fields:
  target: 'foo"
  fields:
  service_name:
  - "that a way"
  - "other"
  - "blahblah"

but successive statements of this nature overwrite, rather than amend, the field contents.

Searching on appending arrays in beats only gets me hits in logstash.

Am I out of luck? Am I silly to scruple at polluting the tags namespace? I really don't want to add tags like

service_name:this
service_name:that

... It seems icky.

[shaunak (Shaunak Kashyap)]

Hi @rout39574, welcome to the Elastic community forums!

Unfortunately, this isn't possible today but this sounds like a useful feature. Would you mind filing a feature request via https://github.com/elastic/beats/issues/new?template=feature-request.md? Perhaps the add_fields processor could take an append_array_values boolean setting or something like that.