# Custom analyser not working

**URL:** <https://discuss.elastic.co/t/custom-analyser-not-working/24953>\
**Category:** Elasticsearch\
**Created:** [July 6, 2015, 12:28pm UTC](https://discuss.elastic.co/t/custom-analyser-not-working/24953 "2015-07-06T12:28:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Malefitz](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@Malefitz](https://discuss.elastic.co/u/Malefitz)\
**Post date:** [July 6, 2015, 12:28pm UTC](https://discuss.elastic.co/t/custom-analyser-not-working/24953/1 "2015-07-06T12:28:33Z")

</div>

Hi,

i'm working on a new template for my syslog messages. Here's my template:

```
PUT _template/syslog
{
"template": "syslog*",
"settings": {
"analysis": {
  "analyzer": {
    "only_lowercase": {
      "type": "custom",
      "tokenizer": "keyword",
      "filter": [
        "lowercase"
      ]
    }
  }
}
},
"mappings": {
"_default_": {
  "properties": {
    "syslog_pid": {
      "type": "integer",
      "index": "not_analyzed"
    },
    "syslog_program": {
      "type": "string",
      "index": "not_analyzed",
      "analyzer": "only_lowercase"
    },
    "syslog_hostname": {
      "type": "string",
      "analyzer": "only_lowercase"
    },
    "syslog_message": {
      "type": "string",
      "analyzer": "only_lowercase"
    },
    "received_from": {
      "type": "ip"
    },
    "host": {
      "type": "ip"
    }
  }
}
}
}

```

I want to lowercase incomming syslog\_hostname, but it's not working. But, if i'm testing with

```
curl 'http://localhost:9200/syslog-2015.07.06/_analyze?analyzer=only_lowercase' -d "Hostname"

```

"Hostname" will be lowercase. So what is going wrong ?

Michael

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:03am UTC](https://discuss.elastic.co/t/custom-analyser-not-working/24953/2 "2017-07-06T00:03:26Z")

</div>