I'm sorry @magnusbaeck i didn't explain weel. Now Logstash upload data in kibana and not give me any error but the request.keyword values aren't lowercase. I fixed the mutate filter, i restart all machines, and uploaded data but i still have request.keyword value like this: //fileadmin/Material/mSite/logo_.GIF?r=90. GIF in uppercase and other characters same. i don't have idea what i can do for transform this url in lowercase. I need this because i want to exclud uppercase jpg css and other of my result query. In the exclude pattern in Kibana you can't specify the ignorecase so i have t upload data already lowercase.