So it's my understanding that we can just use a custom normalizer to provide lowercase search for a given keyword. Is there a way to make this the default for all new keywords that are added, including those automatically added by Beat agents (ex. host.name)? This seems more intuitive for end users, as we're using structured logs and would like to give developers plenty of leeway in terms of what they add without having to get the casing just right during search.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.