# How to do case-insensitive search for a field value?

**URL:** <https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002>\
**Category:** Kibana\
**Created:** [February 15, 2018, 2:19pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002 "2018-02-15T14:19:09Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeremy\_C](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@Jeremy\_C](https://discuss.elastic.co/u/Jeremy_C)\
**Post date:** [February 15, 2018, 2:19pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/1 "2018-02-15T14:19:10Z")

</div>

In Kibana's Discover page search, if I just type "server1" then it does a case-insensitive search.  
But if I do "beat.hostname: server1" then that's a case-sensitive search. How do I do I make that case-insensitive?

I'm hoping this is a really silly/easy question but I just haven't found the answer.

Thanks

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [February 15, 2018, 5:28pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/2 "2018-02-15T17:28:23Z")

</div>

Hmm case-insensitivity works for me with the data loaded from the makelogs script against the host field.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f9b6c3aaab366e678d84a8030dab0b1a50f90f5.png)

that field is mapped as text. Can you check the mappings for the hostname field on that index? Also, what version of Kibana/ES are you running? I checked this against the latest.

---

<div class="post-metadata">

**Author:** ![Jeremy\_C](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@Jeremy\_C](https://discuss.elastic.co/u/Jeremy_C)\
**Post date:** [February 15, 2018, 6:13pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/3 "2018-02-15T18:13:56Z")

</div>

Interesting...for me, it's case-insensitive with logstash index also. But for any of the indices associated with beats (winlogbeat, filebeat, metricbeat) then the same query is case-sensitive.

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [February 15, 2018, 6:53pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/4 "2018-02-15T18:53:27Z")

</div>

mapping you could share the mapping for one of those indices? [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html)

---

<div class="post-metadata">

**Author:** ![Jeremy\_C](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@Jeremy\_C](https://discuss.elastic.co/u/Jeremy_C)\
**Post date:** [February 16, 2018, 1:11pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/5 "2018-02-16T13:11:07Z")

</div>

The mapping is longer than the max 7000 characters for a reply so I'll break it up.  
{  
"winlogbeat-6.1.2-2018.02.12": {  
"mappings": {  
"doc": {  
"\_meta": {  
"version": "6.1.2"  
},  
"dynamic\_templates": [  
{  
"fields": {  
"path\_match": "fields._",  
"match\_mapping\_type": "string",  
"mapping": {  
"type": "keyword"  
}  
}  
},  
{  
"docker.container.labels": {  
"path\_match": "docker.container.labels._",  
"match\_mapping\_type": "string",  
"mapping": {  
"type": "keyword"  
}  
}  
},  
{  
"event\_data": {  
"path\_match": "event\_data._",  
"match\_mapping\_type": "string",  
"mapping": {  
"type": "keyword"  
}  
}  
},  
{  
"user\_data": {  
"path\_match": "user\_data._",  
"match\_mapping\_type": "string",  
"mapping": {  
"type": "keyword"  
}  
}  
},  
{  
"strings\_as\_keyword": {  
"match\_mapping\_type": "string",  
"mapping": {  
"ignore\_above": 1024,  
"type": "keyword"  
}  
}  
}  
],  
"date\_detection": false,  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"activity\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"beat": {  
"properties": {  
"hostname": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"timezone": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"version": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
},  
"computer\_name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"docker": {  
"properties": {  
"container": {  
"properties": {  
"id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"image": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"labels": {  
"type": "object"  
},  
"name": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
}  
}  
},  
"error": {  
"properties": {  
"code": {  
"type": "long"  
},  
"message": {  
"type": "text",  
"norms": false  
},  
"type": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
},

---

<div class="post-metadata">

**Author:** ![Jeremy\_C](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@Jeremy\_C](https://discuss.elastic.co/u/Jeremy_C)\
**Post date:** [February 16, 2018, 1:12pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/6 "2018-02-16T13:12:21Z")

</div>

Part 2 of 3:  
"event\_data": {  
"properties": {  
"AdapterName": {  
"type": "keyword"  
},  
"AdapterSuffixName": {  
"type": "keyword"  
},  
"Address": {  
"type": "keyword"  
},  
"AddressLength": {  
"type": "keyword"  
},  
"AuditPolicyChanges": {  
"type": "keyword"  
},  
"Binary": {  
"type": "keyword"  
},  
"CategoryId": {  
"type": "keyword"  
},  
"ClientName": {  
"type": "keyword"  
},  
"Context": {  
"type": "keyword"  
},  
"DirtyPages": {  
"type": "keyword"  
},  
"DnsServerList": {  
"type": "keyword"  
},  
"ErrorCode": {  
"type": "keyword"  
},  
"HiveName": {  
"type": "keyword"  
},  
"HiveNameLength": {  
"type": "keyword"  
},  
"HostName": {  
"type": "keyword"  
},  
"IP\_Name": {  
"type": "keyword"  
},  
"Ipaddress": {  
"type": "keyword"  
},  
"KeysUpdated": {  
"type": "keyword"  
},  
"Name": {  
"type": "keyword"  
},  
"QueryName": {  
"type": "keyword"  
},  
"ReservationName": {  
"type": "keyword"  
},  
"Sent UpdateServer": {  
"type": "keyword"  
},  
"ServerURL": {  
"type": "keyword"  
},  
"SubcategoryGuid": {  
"type": "keyword"  
},  
"SubcategoryId": {  
"type": "keyword"  
},  
"SubjectDomainName": {  
"type": "keyword"  
},  
"SubjectLogonId": {  
"type": "keyword"  
},  
"SubjectUserName": {  
"type": "keyword"  
},  
"SubjectUserSid": {  
"type": "keyword"  
},  
"TSId": {  
"type": "keyword"  
},  
"Type": {  
"type": "keyword"  
},  
"UserSid": {  
"type": "keyword"  
},  
"param1": {  
"type": "keyword"  
},  
"param10": {  
"type": "keyword"  
},  
"param11": {  
"type": "keyword"  
},  
"param12": {  
"type": "keyword"  
},  
"param2": {  
"type": "keyword"  
},  
"param3": {  
"type": "keyword"  
},  
"param4": {  
"type": "keyword"  
},  
"param5": {  
"type": "keyword"  
},  
"param6": {  
"type": "keyword"  
},  
"param7": {  
"type": "keyword"  
},  
"param8": {  
"type": "keyword"  
},  
"param9": {  
"type": "keyword"  
}  
}  
},  
"event\_id": {  
"type": "long"  
},  
"fields": {  
"type": "object"  
},  
"keywords": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"kubernetes": {  
"properties": {  
"annotations": {  
"type": "object"  
},  
"container": {  
"properties": {  
"image": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"name": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
},  
"labels": {  
"type": "object"  
},  
"namespace": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"pod": {  
"properties": {  
"name": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
}  
}  
},  
"level": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"log\_name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"message": {  
"type": "text",  
"norms": false  
},  
"message\_error": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"meta": {  
"properties": {  
"cloud": {  
"properties": {  
"availability\_zone": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"instance\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"instance\_name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"machine\_type": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"project\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"provider": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"region": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
}  
}  
},  
"opcode": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"process\_id": {  
"type": "long"  
},  
"provider\_guid": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"record\_number": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"related\_activity\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"source\_name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"tags": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"task": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"thread\_id": {  
"type": "long"  
},  
"type": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"user": {  
"properties": {  
"domain": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"identifier": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"type": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
},  
"user\_data": {  
"type": "object"  
},  
"version": {  
"type": "long"  
},  
"xml": {  
"type": "text",  
"norms": false  
}  
}  
},

---

<div class="post-metadata">

**Author:** ![Jeremy\_C](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@Jeremy\_C](https://discuss.elastic.co/u/Jeremy_C)\
**Post date:** [February 16, 2018, 1:12pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/7 "2018-02-16T13:12:55Z")

</div>

Part 3 of 3:

"_default_": {  
"\_meta": {  
"version": "5.6.2"  
},  
"dynamic\_templates": [  
{  
"strings\_as\_keyword": {  
"match\_mapping\_type": "string",  
"mapping": {  
"ignore\_above": 1024,  
"type": "keyword"  
}  
}  
}  
],  
"date\_detection": false,  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"activity\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"beat": {  
"properties": {  
"hostname": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"version": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
},  
"computer\_name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"event\_id": {  
"type": "long"  
},  
"keywords": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"level": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"log\_name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"message": {  
"type": "text",  
"norms": false  
},  
"message\_error": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"meta": {  
"properties": {  
"cloud": {  
"properties": {  
"availability\_zone": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"instance\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"machine\_type": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"project\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"provider": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"region": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
}  
}  
},  
"opcode": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"process\_id": {  
"type": "long"  
},  
"provider\_guid": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"record\_number": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"related\_activity\_id": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"source\_name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"tags": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"task": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"thread\_id": {  
"type": "long"  
},  
"type": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"user": {  
"properties": {  
"domain": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"identifier": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"name": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"type": {  
"type": "keyword",  
"ignore\_above": 1024  
}  
}  
},  
"version": {  
"type": "long"  
},  
"xml": {  
"type": "text",  
"norms": false  
}  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [February 16, 2018, 2:18pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/8 "2018-02-16T14:18:11Z")

</div>

The hostname field is mapped as type keyword. makeLogs maps the host field as text, which does support case insensitive searching by default. So you can remap the field as type text and reindex, or you can try the suggestion in the linked blog article in this discussion:

> [@How to search keyword fields with case insensitive](https://discuss.elastic.co/t/how-to-search-keyword-fields-with-case-insensitive/101704):
>
> Please provide me solution for case insensitive search on keyword field. Like if I am searching for ajit it should display AJIT and all ajit available in elasticsearch data. Currently it giving me exact match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2018, 2:18pm UTC](https://discuss.elastic.co/t/how-to-do-case-insensitive-search-for-a-field-value/120002/9 "2018-03-16T14:18:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.