Append processor
Appends one or more values to an existing array if the field already exists and it is an array. Converts a scalar to an array and appends one or more values to it if the field exists and it is a scalar. Creates an array containing the provided values if the field doesn’t exist. Accepts a single value or an array of values.
Name | Required | Default | Description |
---|---|---|---|
field |
yes | - | The field to be appended to. Supports template snippets. |
value |
yes* | - | The value to be appended. Supports template snippets. May specify only one of value or copy_from . |
copy_from
Stack
|
no | - | The origin field which will be appended to field , cannot set value simultaneously. |
allow_duplicates |
no | true | If false , the processor does not appendvalues already present in the field. |
ignore_empty_values
Stack
|
no | false | If true , the processor does not append values that resolve to null or an empty string. |
media_type |
no | application/json |
The media type for encoding value . Applies only when value is a template snippet. Must be one of application/json , text/plain , orapplication/x-www-form-urlencoded . |
description |
no | - | Description of the processor. Useful for describing the purpose of the processor or its configuration. |
if |
no | - | Conditionally execute the processor. See Conditionally run a processor. |
ignore_failure |
no | false |
Ignore failures for the processor. See Handling pipeline failures. |
on_failure |
no | - | Handle failures for the processor. See Handling pipeline failures. |
tag |
no | - | Identifier for the processor. Useful for debugging and metrics. |
Here is an append
processor definition that adds the string "production"
as well as the values of the app
and owner
fields to the tags
field:
{
"append": {
"field": "tags",
"value": ["production", "{{{app}}}", "{{{owner}}}"]
}
}
Stack
By using allow_duplicates
and ignore_empty_values
, it is possible to only append the host.name
to the related.hosts
if the host.name
is not empty and if the value is not already present in related.hosts
:
{
"append": {
"field": "related.hosts",
"copy_from": "host.name",
"allow_duplicates": false,
"ignore_empty_values": true
}
}