# Convert uppercase in lowercase **URL:** \ **Category:** Logstash\ **Created:** [June 22, 2017, 9:22am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416 "2017-06-22T09:22:36Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\ **Post date:** [June 22, 2017, 9:22am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/1 "2017-06-22T09:22:36Z")
Hi, i've tried to convert field.keyword in lowrcase by using this mapping: filter { mutate { lowercase =\> { match =\> ["request"] } } grok { match =\> { "message" =\> '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:respon$ } } this is my logstash.conf My input field is like: //fileadmin/Material/mSite/logo\_curv.GIF?r=90. i'd like convert all string in lowercase. //fileadmin/material/msite/curv.gif?r=90. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2017, 9:25am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/2 "2017-06-22T09:25:29Z")
> mutate { > lowercase =\> { > match =\> ["request"] > } > } That's not how the `lowercase` option should be used. The documentation contains a correct example. ---
**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\ **Post date:** [June 22, 2017, 9:43am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/3 "2017-06-22T09:43:14Z")
@magnusbaeck when i upload data i recived this error message: ][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=\>#\, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2017, 9:50am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/4 "2017-06-22T09:50:01Z")
Without seeing your configuration file the only thing I can say is that the error message should tell you roughly which line in your configuration file that contains the error. ---
**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\ **Post date:** [June 22, 2017, 10:01am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/5 "2017-06-22T10:01:15Z")
yes sure, i'm sorry @magnusbaeck logstash.conf input { stdin { } } filter { mutate { lowercase =\> { match =\> ["request"] } } grok { match =\> { "message" =\> '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "% {WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}' ``` } ``` } date { match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] target =\> "@timestamp" locale =\> en } geoip { source =\> "clientip" } useragent { source =\> "agent" target =\> "useragent" } } output { stdout { codec =\> dots {} } elasticsearch { hosts =\> ["localhost:9200"] index =\> "apache\_elastic" template =\> "./apache\_template.json" template\_name =\> "apache\_elastic" template\_overwrite =\> true } } for kibana.json i use this on git [https://github.com/elastic/examples/blob/master/ElasticStack\_apache/apache\_kibana.json](https://github.com/elastic/examples/blob/master/ElasticStack_apache/apache_kibana.json) for template.json { "template": "apache\_elastic", "settings": { "index.refresh\_interval": "5s" } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2017, 10:22am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/6 "2017-06-22T10:22:00Z")
> mutate { > lowercase =\> { > match =\> ["request"] > } > } Why haven't you fixed this? ---
**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\ **Post date:** [June 22, 2017, 10:29am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/7 "2017-06-22T10:29:40Z")
@magnusbaeck i've tried to change the filter like documentation but in kibana show request value with uppercase and lowercase. nothing change. and when i use this filter in exclude pattern or in a search bar "._.(png|jpg|gif|js|css)(?._)?" match only lowercase. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2017, 11:32am UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/8 "2017-06-22T11:32:05Z")
At this point I don't know what you want help with. If you're getting the "Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash" error message then you're not getting any data into Kibana because Logstash isn't starting. ---
**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\ **Post date:** [June 22, 2017, 12:41pm UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/9 "2017-06-22T12:41:51Z")
I'm sorry @magnusbaeck i didn't explain weel. Now Logstash upload data in kibana and not give me any error but the request.keyword values aren't lowercase. I fixed the mutate filter, i restart all machines, and uploaded data but i still have request.keyword value like this: //fileadmin/Material/mSite/logo\_.GIF?r=90. GIF in uppercase and other characters same. i don't have idea what i can do for transform this url in lowercase. I need this because i want to exclud uppercase jpg css and other of my result query. In the exclude pattern in Kibana you can't specify the ignorecase so i have t upload data already lowercase. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2017, 1:04pm UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/10 "2017-06-22T13:04:43Z")
Please show an example event, e.g. copied from the JSON tab of Kibana's Discover panel. Also, what does your configuration look like now? ---
**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\ **Post date:** [June 22, 2017, 1:27pm UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/11 "2017-06-22T13:27:59Z")
![](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e008cffcec12693eb358bbe05c8ec17ec089dead.png) This is JSONobject and for about configuration are the same before copied but i fixed filter. Now: filter { mutate { lowercase =\> ["request"] } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2017, 1:37pm UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/12 "2017-06-22T13:37:19Z")
The mutate filter must come after the grok filter. Filters are evaluated in order and until the grok filter has run there is no `request` field. ---
**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\ **Post date:** [June 22, 2017, 1:44pm UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/13 "2017-06-22T13:44:59Z")
Thank you very much @magnusbaeck it go. This is the solution: filter { grok { match =\> { "message" =\> '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:resp$ } } mutate { lowercase =\> ["request"] } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 20, 2017, 1:45pm UTC](https://discuss.elastic.co/t/convert-uppercase-in-lowercase/90416/14 "2017-07-20T13:45:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.