From be8ab652a4bec6b357fc7c420d3eb57891954a22 Mon Sep 17 00:00:00 2001 From: johnmschoonover Date: Mon, 1 May 2023 09:56:46 -0500 Subject: [PATCH] Fix the merge function of the mutate filter The dest_field_value was derived before the added fields were iterated upon. This caused the subsequent `event.set`'s, when iterating over multiple `added_field_value`'s, to set the `dest_field` based on the _initial_ `dest_field_value`. The logic should, instead, update the `dest_field_value` on each iteration of `added_field` so that it may continue to add to the `dest_field_value` instead of always only adding the last item in the list. --- lib/logstash/filters/mutate.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/logstash/filters/mutate.rb b/lib/logstash/filters/mutate.rb index b0693a4..0172348 100644 --- a/lib/logstash/filters/mutate.rb +++ b/lib/logstash/filters/mutate.rb @@ -508,9 +508,8 @@ def merge(event) @merge.each do |dest_field, added_fields| # When multiple calls, added_field is an array - dest_field_value = event.get(dest_field) - Array(added_fields).each do |added_field| + dest_field_value = event.get(dest_field) added_field_value = event.get(added_field) if dest_field_value.is_a?(Hash) ^ added_field_value.is_a?(Hash)