From Rob:
With the add_field mutation, if a field already exists, the new value will be appended to the end of the previous value as an array. The documentation for add_field doesn't mention that fact at all.
It seems like there are a couple of areas for improvements here - being explicit in our documentation around what happens with the add_field mutation when the field already exists - that it can transform an expected string or number into an array, and also clear up the story around arrays and the list property.
From Andre:
I took a look at the github repos and hope that are the places to be edited:
../../../../logstash/docs/include/input.asciidoc
{logstash-ref}/configuration-file-structure.html#string
type is string
From Rob: With the add_field mutation, if a field already exists, the new value will be appended to the end of the previous value as an array. The documentation for add_field doesn't mention that fact at all.
It seems like there are a couple of areas for improvements here - being explicit in our documentation around what happens with the add_field mutation when the field already exists - that it can transform an expected string or number into an array, and also clear up the story around arrays and the list property.
From Andre: I took a look at the github repos and hope that are the places to be edited: ../../../../logstash/docs/include/input.asciidoc {logstash-ref}/configuration-file-structure.html#string type is string
L139 https://github.com/elastic/logstash/edit/master/docs/include/input.asciidoc
Array Deprecated
L89 https://github.com/elastic/logstash/edit/master/docs/static/configuration.asciidoc
String no mention that this can become an array as well
253 https://github.com/elastic/logstash/edit/master/docs/static/configuration.asciidoc
add_field ../../../../logstash/docs/include/filter.asciidoc
42 - #73 https://github.com/elastic/logstash/edit/master/docs/include/filter.asciidoc
Reference: 7203