How to lowercase a field for creating index in filebeat?

Elastic Stack Beats
1

I am using index template to create dynamic indices,

setup.ilm.enabled: false
setup.template.enabled: true
setup.template.name: "testing"
setup.template.pattern: "testing-*"
setup.template.overwrite: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "testing-%{[MessageType]}"

The issue is that the field might not return all lowercase characters each time, so is there any way to convert the value of field to lowercase since indices do not accept uppercase characters.

2

Hi!

I would try to process the events and make the field lowercase with script processor.

C.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.