Correct, it may be more logical to apply to the set. Append should append either to a string or array.
I can confirm that is indeed the current situation, I will bring it up and keep you posted 
I do think that it would be easier to allow append to create a List even though the field does not exist yet, but I want to check with the team how we want to approach it.
Feel free to track any progress or discussion here: [Filebeat][httpjson input] Unable to create body with single value list · Issue #25060 · elastic/beats · GitHub
The appropriate PR has been created here: [Filebeat][httpjson] Change append transform to initiate new fields as a slice by P1llus · Pull Request #25074 · elastic/beats · GitHub
It should be merged pretty soon, so it should be expected in 7.13, if you can't wait you would unfortunately have to compile the build from source, hope that helps!
The new syntax would be:
append:
set: body.service
value: 'value1'This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.