Adding a copy field and set it lowercase

Elastic Stack Logstash
1

Hello guys,

I'm having a trouble with a mutate filter, where i need to set a field copy to lowercase.
But when i try to load on elastic , the field copy won't be lowercase.

My Logstash Version is 5.2

i'm using the configuration below:

filter {   
        mutate {
            rename => {"desc_ufe" => "state" }
            rename => {"desc_local" => "city" }
            rename => {"desc_bairro" => "neighborhood" }
            rename => {"desc_lograd" => "streetName" }
            rename => {"desc_cep" => "postalCode" }
            rename => {"desc_lograd_complemento" => "supplement" }
            rename => {"cod_mun" => "IBGEcode" }
            
            convert => {"IBGEcode" => "string"}
            
            add_field => {"statecp" => "%{state}"}
            add_field => {"citycp" => "%{city}"}
            add_field => {"neighborhoodcp" => "%{neighborhood}"}
            add_field => {"streetNamecp" => "%{streetName}"}
            add_field => {"supplementcp" => "%{supplement}"}

            lowercase => ["statecp","citycp","neighborhoodcp","streetNamecp","supplementcp"]
        }
     }

Thank you for any help.

2

Split the lowercase into a separate mutate filter. mutate does operations in a fixed order and it is doing the lowercase before those fields have been created.

1 Like
3

Thank you Badger , it worked as should.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.