Append processor

Appends one or more values to an existing array if the field already exists and it is an array. Converts a scalar to an array and appends one or more values to it if the field exists and it is a scalar. Creates an array containing the provided values if the field doesn’t exist. Accepts a single value or an array of values.

Name	Required	Default	Description
`field`	yes	-	The field to be appended to. Supports template snippets.
`value`	yes*	-	The value to be appended. Supports template snippets. May specify only one of `value` or `copy_from`.
`copy_from` The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.	no	-	The origin field which will be appended to `field`, cannot set `value` simultaneously.
`allow_duplicates`	no	true	If `false`, the processor does not appendvalues already present in the field.
`ignore_empty_values` The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.	no	false	If `true`, the processor does not append values that resolve to `null` or an empty string.
`media_type`	no	`application/json`	The media type for encoding `value`. Applies only when `value` is a template snippet. Must be one of `application/json`, `text/plain`, or`application/x-www-form-urlencoded`.
`description`	no	-	Description of the processor. Useful for describing the purpose of the processor or its configuration.
`if`	no	-	Conditionally execute the processor. See Conditionally run a processor.
`ignore_failure`	no	`false`	Ignore failures for the processor. See Handling pipeline failures.
`on_failure`	no	-	Handle failures for the processor. See Handling pipeline failures.
`tag`	no	-	Identifier for the processor. Useful for debugging and metrics.

Examples

Simple example

Here is an append processor definition that adds the string "production" as well as the values of the app and owner fields to the tags field:

{
  "append": {
    "field": "tags",
    "value": ["production", "{{{app}}}", "{{{owner}}}"]
  }
}

Example using `allow_duplicates` and `ignore_empty_values`

By using allow_duplicates and ignore_empty_values, it is possible to only append the host.name to the related.hosts if the host.name is not empty and if the value is not already present in related.hosts:

{
  "append": {
    "field": "related.hosts",
    "copy_from": "host.name",
    "allow_duplicates": false,
    "ignore_empty_values": true
  }
}