Two fields share the same name and type, how to combine them into 1 field?

[austin0918]

Hi guys, I have two fields share the same name and type in an index, one is generated due to a kv{} filter, the second one is generated due to mutate {add_field => {"Classification" => ""}} filter. Is there a way to combine them together?

When I do a search, the value presents in the two Classification field.

[Badger]

The only way I can think of that that could happen is that the field derived from the kv filter actually has a leading or trailing space in the field name, so it is actually called "Classificiation " rather than "Classification". If that is the case then a trim_key option to the kv filter might help.

[austin0918]

Thank you Badger. I'll give it a try and let you know.

[austin0918]

Thank you again Badger. You're right. There is a leading space in the field name and trim_key did magic.