# Multiple merges in one mutate causes override

**URL:** <https://discuss.elastic.co/t/multiple-merges-in-one-mutate-causes-override/171525>\
**Category:** Logstash\
**Created:** [March 8, 2019, 3:49pm UTC](https://discuss.elastic.co/t/multiple-merges-in-one-mutate-causes-override/171525 "2019-03-08T15:49:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tacomaster](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@tacomaster](https://discuss.elastic.co/u/tacomaster)\
**Post date:** [March 8, 2019, 3:49pm UTC](https://discuss.elastic.co/t/multiple-merges-in-one-mutate-causes-override/171525/1 "2019-03-08T15:49:48Z")

</div>

Hi,  
Having multiple merge settings in a mutate appears to only keep the last merge.

```auto
mutate {
    add_field => {"[array_field]" => []}
    merge => {"[array_field]"=> "[field_1]"}
    merge => {"[array_field]"=> "[field_2]"}
}

```

That config will result in array\_field only containing field\_2

However, if I use the config below, array\_field will contain both field\_1 and field\_2.

```auto
mutate {
    add_field => {"[array_field]" => []}
    merge => {"[array_field]"=> "[field_1]"}
}
mutate {
    merge => {"[array_field]"=> "[field_2]"}
}

```

Is this a bug or is it work as intended?  
Using Logstash 6.6.1

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 8, 2019, 4:36pm UTC](https://discuss.elastic.co/t/multiple-merges-in-one-mutate-causes-override/171525/2 "2019-03-08T16:36:43Z")

</div>

```
add_field => {"[array_field]" => []}

```

This does not add a field to the event. Even if it did, add\_field is decoration, which is done after the merge.

Reading through the code I would expect both merges to work. Not sure why it does not.

This does work

```
    ruby { code => ' event.set("a", [])' }
    mutate { add_field => { "b" => 1 "c" => 2 } }
    mutate { merge => { "a" => "b" } merge => { "a" => "c" } }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2019, 4:36pm UTC](https://discuss.elastic.co/t/multiple-merges-in-one-mutate-causes-override/171525/3 "2019-04-05T16:36:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.