Multiple merges in one mutate causes override

Hi,
Having multiple merge settings in a mutate appears to only keep the last merge.

mutate {
    add_field => {"[array_field]" => []}
    merge => {"[array_field]"=> "[field_1]"}
    merge => {"[array_field]"=> "[field_2]"}
}

That config will result in array_field only containing field_2

However, if I use the config below, array_field will contain both field_1 and field_2.

mutate {
    add_field => {"[array_field]" => []}
    merge => {"[array_field]"=> "[field_1]"}
}
mutate {
    merge => {"[array_field]"=> "[field_2]"}
}

Is this a bug or is it work as intended?
Using Logstash 6.6.1

add_field => {"[array_field]" => []}

This does not add a field to the event. Even if it did, add_field is decoration, which is done after the merge.

Reading through the code I would expect both merges to work. Not sure why it does not.

This does work

    ruby { code => ' event.set("a", [])' }
    mutate { add_field => { "b" => 1 "c" => 2 } }
    mutate { merge => { "a" => "b" } merge => { "a" => "c" } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.