Single Item Arrays should perform like multiple item arrays

[tebriel]

I use json parsing for log bodies, and then I split these items out to become separate messages. I have a log line like:

Jan 5 18:00:00 CLOUDSERVER ui[14253]: Telemetry_JSON[RM7TT15WMLU9bDz8OV_3Vg]: line 1/1 {"metrics": ["servers.server1.snmp.devices.app01.cpu.1.1.1.1 2872 1452016719\n"], "user": ""}

After I json parse the {.*}, I run split on "metrics" and then run csv on each item in "metrics" to split out the items into a new event to output to elasticsearch and datadog. I feel like a single item array should be treated like a multi-item array. An array with a single item doesn't seem like it should just ignore the array.

[tebriel]

Minor clarification on behavior.
if you have message => [“a”, “b”], and you call split, you’ll get message => “a”, and message => “b”
but if you have message => [“a”], you’ll get message => [“a”] in the original behavior, and message => "a" in my proposed behavior.

[jordansissel]

+1 on this proposal

[jordansissel]

Tests pass for me.

[elasticsearch-bot]

Jordan Sissel merged this into the following branches!

Branch	Commits
master	8714426

[jordansissel]

LGTM

[tebriel]

Thanks!