The hostname field is mapped as type keyword. makeLogs maps the host field as text, which does support case insensitive searching by default. So you can remap the field as type text and reindex, or you can try the suggestion in the linked blog article in this discussion: