Can I create a one-item array in Logstash?

Question

I have a use case where a String field sometimes contains one value and sometime contains multiple values. This is causing a problem downstream because our avro schema specifies type "Array" on this field but sometime receives a "String" type.

I have no way to change the downstream logic and I would rather like to avoid converting my Arrays to concatenated Strings as a workaround. Is there a way to create a one-item Array in Logstash?

Research

There is a convert filter in Logstash but it doesn't explicitly allow for conversion to String Arrays and the following does not work:

mutate {
    convert => {"FieldName" => "[string]"}
}

I have also tried explicitly recreating the field as an Array with no luck.

mutate {
    add_field => { "[FieldName_temp]" => "%{FieldName}" }
    remove_field => { "FieldName" }
}

mutate {
    rename => { "[FieldName_temp]" => "[FieldName]" }
}

Is what I'm attempting even possible in Logstash?

question from:https://stackoverflow.com/questions/66051708/can-i-create-a-one-item-array-in-logstash

Answer 1

The common filter option add_field will convert a string to an array if the field already exists, or append an entry to an array, then you can remove the last entry in the array.

mutate { add_field => { "foo" => 2 } }
mutate { remove_field => [ "[foo][-1]" ] }

You could also do it using a ruby filter, but I think this is harder to understand:

ruby { code => 'event.set("foo", [ event.get("foo") ].flatten)' }