add_field should default to single and promote if there is an array


Currently add_field add a single value as an array, it does as you can add a array.

This should this be addressed in all filters that have add_field.

17:25 whack: kubes_: the idea is you can do any number of add_field on the same field
17:25 whack: it perhaps should default to a single value and promote to an array later
17:25 whack: but whatever it does now is on purpose, but we can change it.
17:27 kubes_: I think it would be better to default to a single. electrical seems to think so too. Should this be a feature request?
17:27 whack: yeah


Logstash Developers


Philip Kubat



Fix versions

Affects versions