# Create array with only one element

**URL:** <https://discuss.elastic.co/t/create-array-with-only-one-element/170572>\
**Category:** Logstash\
**Created:** [March 1, 2019, 11:19pm UTC](https://discuss.elastic.co/t/create-array-with-only-one-element/170572 "2019-03-01T23:19:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Idar\_Lund](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/idar_lund/32/41482_2.png) [@Idar\_Lund](https://discuss.elastic.co/u/Idar_Lund)\
**Post date:** [March 1, 2019, 11:19pm UTC](https://discuss.elastic.co/t/create-array-with-only-one-element/170572/1 "2019-03-01T23:19:09Z")

</div>

Hi,

I'm trying to create an array with only one element, so that I can add more elements to it later with elasticsearch action update and script.

When adding an array with two elements like this:  
filter {  
mutate {  
add\_field =\> {"path2" =\> ["%{path}","5"]}  
}  
}

I get an array element in elasticsearch like this:  
"path2": [  
"/path/to/my/file.txt",  
"5"  
]

But if I remove the "5" and write it like this:  
add\_field =\> {"path2" =\> ["%{path}"]}  
I get a "path2" entry in elasticsearch which is not an array:  
"path2":"/path/to/my/file.txt"

How can I create an array with only one element in it so that I can add elements to that array later?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 1, 2019, 11:30pm UTC](https://discuss.elastic.co/t/create-array-with-only-one-element/170572/2 "2019-03-01T23:30:01Z")

</div>

```
ruby { code => 'event.set("path2", [event.get("path")])' }
```

---

<div class="post-metadata">

**Author:** ![Idar\_Lund](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/idar_lund/32/41482_2.png) [@Idar\_Lund](https://discuss.elastic.co/u/Idar_Lund)\
**Post date:** [March 2, 2019, 8:33am UTC](https://discuss.elastic.co/t/create-array-with-only-one-element/170572/3 "2019-03-02T08:33:34Z")

</div>

Thanks a lot! That worked perfectly.  
Is it only possible to add an array with just one element through ruby code? Or is there a way to solve this without having to use the ruby filter plugin?

In case someone is trying to do the same as I do here's my full logstash config:

```
input {
    file {
        path => "/path/to/my/files/**/*.*"
    }
}

filter {
    grok {
	    #to match a csv file with two elements
        match => { "message" => "%{GREEDYDATA:field1}[;:]%{GREEDYDATA:field2}" }
    }
    ruby { code => 'event.set("path", [event.get("path")])' }

    fingerprint {
        method => "SHA1"
        concatenate_sources => "true"
        source => ["field1","field2"]
        key => ""
        target => "[@metadata][fingerprint]"
    }
}

output {
    elasticsearch {
        hosts => "http://elasticsearch:9200"
        document_id => "%{[@metadata][fingerprint]}"
        index => "test-duplicate"
        action => "update"
        doc_as_upsert => "true"
        script => 'ctx._source.path.add("%{path}");'
    }
}

```

This config will update "path" with an array of elements where the combination of field1 and field2 are duplicate with something that's already saved in elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 30, 2019, 8:33am UTC](https://discuss.elastic.co/t/create-array-with-only-one-element/170572/4 "2019-03-30T08:33:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.