From 3ef3eaf747b0acc0427411ccfa893ff34994cdf3 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Mon, 31 Jan 2022 16:18:31 -0800 Subject: [PATCH] Added info about ability to overwrite (#29944) (#30117) * Added info about ability to overwrite Co-authored-by: Brandon Morelli Co-authored-by: DeDe Morton Co-authored-by: mr1716 --- libbeat/processors/actions/docs/add_fields.asciidoc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libbeat/processors/actions/docs/add_fields.asciidoc b/libbeat/processors/actions/docs/add_fields.asciidoc index b133d2115c89..574c4a684c24 100644 --- a/libbeat/processors/actions/docs/add_fields.asciidoc +++ b/libbeat/processors/actions/docs/add_fields.asciidoc @@ -6,8 +6,9 @@ ++++ The `add_fields` processor adds additional fields to the event. Fields can be -scalar values, arrays, dictionaries, or any nested combination of these. By -default the fields that you specify will be grouped under the `fields` +scalar values, arrays, dictionaries, or any nested combination of these. +The `add_fields` processor will overwrite the target field if it already exists. +By default the fields that you specify will be grouped under the `fields` sub-dictionary in the event. To group the fields under a different sub-dictionary, use the `target` setting. To store the fields as top-level fields, set `target: ''`.