How to lowercase a field for creating index in filebeat?

I am using index template to create dynamic indices,

setup.ilm.enabled: false
setup.template.enabled: true "testing"
setup.template.pattern: "testing-*"
setup.template.overwrite: true

  hosts: ["localhost:9200"]
  index: "testing-%{[MessageType]}"

The issue is that the field might not return all lowercase characters each time, so is there any way to convert the value of field to lowercase since indices do not accept uppercase characters.


I would try to process the events and make the field lowercase with script processor.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.