# Header transform concern need help

**URL:** <https://discuss.elastic.co/t/header-transform-concern-need-help/269064>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 1, 2021, 5:09pm UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064 "2021-04-01T17:09:20Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![jkaufmanlr](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\
**Post date:** [April 7, 2021, 4:33pm UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064/21 "2021-04-07T16:33:20Z")

</div>

Correct, it may be more logical to apply to the set. Append should append either to a string or array.

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [April 14, 2021, 1:14am UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064/22 "2021-04-14T01:14:57Z")

</div>

I can confirm that is indeed the current situation, I will bring it up and keep you posted 🙂

I do think that it would be easier to allow append to create a List even though the field does not exist yet, but I want to check with the team how we want to approach it.

Feel free to track any progress or discussion here: [[Filebeat][httpjson input] Unable to create body with single value list · Issue #25060 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/25060)

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [April 14, 2021, 12:00pm UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064/23 "2021-04-14T12:00:51Z")

</div>

The appropriate PR has been created here: [[Filebeat][httpjson] Change append transform to initiate new fields as a slice by P1llus · Pull Request #25074 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/25074)

It should be merged pretty soon, so it should be expected in 7.13, if you can't wait you would unfortunately have to compile the build from source, hope that helps!

The new syntax would be:

```
append:
  set: body.service
  value: 'value1'
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2021, 2:01pm UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064/24 "2021-05-12T14:01:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/header-transform-concern-need-help/269064.md?page=1)