# Logstash mutate add\_field **URL:** \ **Category:** Logstash\ **Created:** [June 30, 2016, 6:12pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459 "2016-06-30T18:12:54Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Sridhar\_Yadav\_Manoha](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)\ **Post date:** [June 30, 2016, 6:12pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/1 "2016-06-30T18:12:54Z")
I have an xml which I have an attached I am parsing this xml using xml filters in logstash. I have a field t ="296" in my xml. This represents response time. And logstash is parsing each field as an array like "response\_time" =\> [ [0] "296" [1] "296" ] I want it to be a single value instead of an array. "response\_time" =\> 296 I have attached both my input xml file ,my logstash configuration and my logstash ouput. Kindly help me. ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f3e78ba9efde3643613f81c5ebf89f64e67cbb90.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/f/ffca9c3ffbddb3bf4e139ab963c02d0707b6474f.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/4/4b8e18948c639b924d2a044e443ac6e2a14902c8.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 30, 2016, 6:38pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/2 "2016-06-30T18:38:16Z")
Please don't post screenshots. They're hard to read and can't be copied/pasted from. Your mutate filter with `add_field` is useless, remove it. ---
**Author:** ![Sridhar\_Yadav\_Manoha](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)\ **Post date:** [June 30, 2016, 6:42pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/3 "2016-06-30T18:42:45Z")
Sure sorry for the screenshots. I was not able to copy/paste here because I'm working inside a Oracle Client connection. I removed mutate filter add\_field. I am getting "response\_time" =\>[ [0] "296" ] in my response. It is still an array. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 30, 2016, 7:11pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/4 "2016-06-30T19:11:06Z")
> If I don't use add\_field I'm not getting the values. > I am getting "response\_time" =\> "%{response\_time}" Then the `response_time` field didn't exist at that time. It's hard to help since a) you're deleting the `message` field that contains useful information about exactly what the input looks like and b) screenshots can't be copied from. ---
**Author:** ![Sridhar\_Yadav\_Manoha](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)\ **Post date:** [June 30, 2016, 7:16pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/5 "2016-06-30T19:16:15Z")
Please could check my edited response. I removed mutate filter add\_field. I am getting "response\_time" =\>[ [0] "296" ] in my response. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 30, 2016, 7:17pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/6 "2016-06-30T19:17:38Z")
Recent versions of the xml filter have a `force_array` option that you can disable to not create array fields unless actually needed. ---
**Author:** ![Sridhar\_Yadav\_Manoha](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)\ **Post date:** [June 30, 2016, 7:23pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/7 "2016-06-30T19:23:25Z")
> [@magnusbaeck](#): > > force\_array xml { force\_array =\> "false" } Still not working. Is it the right way to disable it? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 30, 2016, 7:25pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/8 "2016-06-30T19:25:34Z")
I wouldn't use the double quotes but it should work anyway. What version of the xml filter is this? ---
**Author:** ![Sridhar\_Yadav\_Manoha](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)\ **Post date:** [June 30, 2016, 7:37pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/9 "2016-06-30T19:37:47Z")
I just updated to 2.3.0. Still I'm facing the same issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/logstash-mutate-add-field/54459/10 "2017-07-06T04:50:02Z")