# Append values to array with filebeat processors

**URL:** <https://discuss.elastic.co/t/append-values-to-array-with-filebeat-processors/220452>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 21, 2020, 9:02pm UTC](https://discuss.elastic.co/t/append-values-to-array-with-filebeat-processors/220452 "2020-02-21T21:02:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rout39574](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@rout39574](https://discuss.elastic.co/u/rout39574)\
**Post date:** [February 21, 2020, 9:02pm UTC](https://discuss.elastic.co/t/append-values-to-array-with-filebeat-processors/220452/1 "2020-02-21T21:02:46Z")

</div>

I would like to incrementally set multivalue fields in a succession of processor statements.

What I want to do is analogous to a series of add\_tags processors with various conditions; but I don't want to pollute the 'tags' namespace with facets local to a single service.

I can set multivalue fields with e.g.

- add\_fields:  
target: 'foo"  
fields:  
service\_name:  
- "that a way"  
- "other"  
- "blahblah"

but successive statements of this nature overwrite, rather than amend, the field contents.

Searching on appending arrays in beats only gets me hits in logstash.

Am I out of luck? Am I silly to scruple at polluting the tags namespace? I really don't want to add tags like

service\_name:this  
service\_name:that

... It seems icky.

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [February 21, 2020, 11:00pm UTC](https://discuss.elastic.co/t/append-values-to-array-with-filebeat-processors/220452/2 "2020-02-21T23:00:16Z")

</div>

Hi @rout39574, welcome to the Elastic community forums!

Unfortunately, this isn't possible today but this sounds like a useful feature. Would you mind filing a feature request via [https://github.com/elastic/beats/issues/new?template=feature-request.md](https://github.com/elastic/beats/issues/new?template=feature-request.md)? Perhaps the `add_fields` processor could take an `append_array_values` boolean setting or something like that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2020, 11:00pm UTC](https://discuss.elastic.co/t/append-values-to-array-with-filebeat-processors/220452/3 "2020-03-20T23:00:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.