How to do case-insensitive search for a field value?

[Jeremy_C]

In Kibana's Discover page search, if I just type "server1" then it does a case-insensitive search.
But if I do "beat.hostname: server1" then that's a case-sensitive search. How do I do I make that case-insensitive?

I'm hoping this is a really silly/easy question but I just haven't found the answer.

Thanks

[Bill_McConaghy]

Hmm case-insensitivity works for me with the data loaded from the makelogs script against the host field.

that field is mapped as text. Can you check the mappings for the hostname field on that index? Also, what version of Kibana/ES are you running? I checked this against the latest.

[Jeremy_C]

Interesting...for me, it's case-insensitive with logstash index also. But for any of the indices associated with beats (winlogbeat, filebeat, metricbeat) then the same query is case-sensitive.

[Bill_McConaghy]

mapping you could share the mapping for one of those indices? https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html

[Jeremy_C]

The mapping is longer than the max 7000 characters for a reply so I'll break it up.
{
"winlogbeat-6.1.2-2018.02.12": {
"mappings": {
"doc": {
"_meta": {
"version": "6.1.2"
},
"dynamic_templates": [
{
"fields": {
"path_match": "fields.",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"docker.container.labels": {
"path_match": "docker.container.labels.",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"event_data": {
"path_match": "event_data.",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"user_data": {
"path_match": "user_data.",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
],
"date_detection": false,
"properties": {
"@timestamp": {
"type": "date"
},
"activity_id": {
"type": "keyword",
"ignore_above": 1024
},
"beat": {
"properties": {
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"timezone": {
"type": "keyword",
"ignore_above": 1024
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"computer_name": {
"type": "keyword",
"ignore_above": 1024
},
"docker": {
"properties": {
"container": {
"properties": {
"id": {
"type": "keyword",
"ignore_above": 1024
},
"image": {
"type": "keyword",
"ignore_above": 1024
},
"labels": {
"type": "object"
},
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"error": {
"properties": {
"code": {
"type": "long"
},
"message": {
"type": "text",
"norms": false
},
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
},

[Jeremy_C]

Part 2 of 3:
"event_data": {
"properties": {
"AdapterName": {
"type": "keyword"
},
"AdapterSuffixName": {
"type": "keyword"
},
"Address": {
"type": "keyword"
},
"AddressLength": {
"type": "keyword"
},
"AuditPolicyChanges": {
"type": "keyword"
},
"Binary": {
"type": "keyword"
},
"CategoryId": {
"type": "keyword"
},
"ClientName": {
"type": "keyword"
},
"Context": {
"type": "keyword"
},
"DirtyPages": {
"type": "keyword"
},
"DnsServerList": {
"type": "keyword"
},
"ErrorCode": {
"type": "keyword"
},
"HiveName": {
"type": "keyword"
},
"HiveNameLength": {
"type": "keyword"
},
"HostName": {
"type": "keyword"
},
"IP_Name": {
"type": "keyword"
},
"Ipaddress": {
"type": "keyword"
},
"KeysUpdated": {
"type": "keyword"
},
"Name": {
"type": "keyword"
},
"QueryName": {
"type": "keyword"
},
"ReservationName": {
"type": "keyword"
},
"Sent UpdateServer": {
"type": "keyword"
},
"ServerURL": {
"type": "keyword"
},
"SubcategoryGuid": {
"type": "keyword"
},
"SubcategoryId": {
"type": "keyword"
},
"SubjectDomainName": {
"type": "keyword"
},
"SubjectLogonId": {
"type": "keyword"
},
"SubjectUserName": {
"type": "keyword"
},
"SubjectUserSid": {
"type": "keyword"
},
"TSId": {
"type": "keyword"
},
"Type": {
"type": "keyword"
},
"UserSid": {
"type": "keyword"
},
"param1": {
"type": "keyword"
},
"param10": {
"type": "keyword"
},
"param11": {
"type": "keyword"
},
"param12": {
"type": "keyword"
},
"param2": {
"type": "keyword"
},
"param3": {
"type": "keyword"
},
"param4": {
"type": "keyword"
},
"param5": {
"type": "keyword"
},
"param6": {
"type": "keyword"
},
"param7": {
"type": "keyword"
},
"param8": {
"type": "keyword"
},
"param9": {
"type": "keyword"
}
}
},
"event_id": {
"type": "long"
},
"fields": {
"type": "object"
},
"keywords": {
"type": "keyword",
"ignore_above": 1024
},
"kubernetes": {
"properties": {
"annotations": {
"type": "object"
},
"container": {
"properties": {
"image": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"labels": {
"type": "object"
},
"namespace": {
"type": "keyword",
"ignore_above": 1024
},
"pod": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"level": {
"type": "keyword",
"ignore_above": 1024
},
"log_name": {
"type": "keyword",
"ignore_above": 1024
},
"message": {
"type": "text",
"norms": false
},
"message_error": {
"type": "keyword",
"ignore_above": 1024
},
"meta": {
"properties": {
"cloud": {
"properties": {
"availability_zone": {
"type": "keyword",
"ignore_above": 1024
},
"instance_id": {
"type": "keyword",
"ignore_above": 1024
},
"instance_name": {
"type": "keyword",
"ignore_above": 1024
},
"machine_type": {
"type": "keyword",
"ignore_above": 1024
},
"project_id": {
"type": "keyword",
"ignore_above": 1024
},
"provider": {
"type": "keyword",
"ignore_above": 1024
},
"region": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"opcode": {
"type": "keyword",
"ignore_above": 1024
},
"process_id": {
"type": "long"
},
"provider_guid": {
"type": "keyword",
"ignore_above": 1024
},
"record_number": {
"type": "keyword",
"ignore_above": 1024
},
"related_activity_id": {
"type": "keyword",
"ignore_above": 1024
},
"source_name": {
"type": "keyword",
"ignore_above": 1024
},
"tags": {
"type": "keyword",
"ignore_above": 1024
},
"task": {
"type": "keyword",
"ignore_above": 1024
},
"thread_id": {
"type": "long"
},
"type": {
"type": "keyword",
"ignore_above": 1024
},
"user": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"identifier": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"user_data": {
"type": "object"
},
"version": {
"type": "long"
},
"xml": {
"type": "text",
"norms": false
}
}
},

[Jeremy_C]

Part 3 of 3:

"default": {
"_meta": {
"version": "5.6.2"
},
"dynamic_templates": [
{
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
],
"date_detection": false,
"properties": {
"@timestamp": {
"type": "date"
},
"activity_id": {
"type": "keyword",
"ignore_above": 1024
},
"beat": {
"properties": {
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"computer_name": {
"type": "keyword",
"ignore_above": 1024
},
"event_id": {
"type": "long"
},
"keywords": {
"type": "keyword",
"ignore_above": 1024
},
"level": {
"type": "keyword",
"ignore_above": 1024
},
"log_name": {
"type": "keyword",
"ignore_above": 1024
},
"message": {
"type": "text",
"norms": false
},
"message_error": {
"type": "keyword",
"ignore_above": 1024
},
"meta": {
"properties": {
"cloud": {
"properties": {
"availability_zone": {
"type": "keyword",
"ignore_above": 1024
},
"instance_id": {
"type": "keyword",
"ignore_above": 1024
},
"machine_type": {
"type": "keyword",
"ignore_above": 1024
},
"project_id": {
"type": "keyword",
"ignore_above": 1024
},
"provider": {
"type": "keyword",
"ignore_above": 1024
},
"region": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"opcode": {
"type": "keyword",
"ignore_above": 1024
},
"process_id": {
"type": "long"
},
"provider_guid": {
"type": "keyword",
"ignore_above": 1024
},
"record_number": {
"type": "keyword",
"ignore_above": 1024
},
"related_activity_id": {
"type": "keyword",
"ignore_above": 1024
},
"source_name": {
"type": "keyword",
"ignore_above": 1024
},
"tags": {
"type": "keyword",
"ignore_above": 1024
},
"task": {
"type": "keyword",
"ignore_above": 1024
},
"thread_id": {
"type": "long"
},
"type": {
"type": "keyword",
"ignore_above": 1024
},
"user": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"identifier": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"version": {
"type": "long"
},
"xml": {
"type": "text",
"norms": false
}
}
}
}
}
}

[Bill_McConaghy]

The hostname field is mapped as type keyword. makeLogs maps the host field as text, which does support case insensitive searching by default. So you can remap the field as type text and reindex, or you can try the suggestion in the linked blog article in this discussion:

How to search keyword fields with case insensitive

Please provide me solution for case insensitive search on keyword field. Like if I am searching for ajit it should display AJIT and all ajit available in elasticsearch data. Currently it giving me exact match.