Hi,
Having multiple merge settings in a mutate appears to only keep the last merge.
mutate {
add_field => {"[array_field]" => []}
merge => {"[array_field]"=> "[field_1]"}
merge => {"[array_field]"=> "[field_2]"}
}
That config will result in array_field only containing field_2
However, if I use the config below, array_field will contain both field_1 and field_2.
mutate {
add_field => {"[array_field]" => []}
merge => {"[array_field]"=> "[field_1]"}
}
mutate {
merge => {"[array_field]"=> "[field_2]"}
}
Is this a bug or is it work as intended?
Using Logstash 6.6.1