# How to lowercase a field for creating index in filebeat?

**URL:** <https://discuss.elastic.co/t/how-to-lowercase-a-field-for-creating-index-in-filebeat/221146>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 27, 2020, 5:36am UTC](https://discuss.elastic.co/t/how-to-lowercase-a-field-for-creating-index-in-filebeat/221146 "2020-02-27T05:36:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aksroh](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@aksroh](https://discuss.elastic.co/u/aksroh)\
**Post date:** [February 27, 2020, 5:36am UTC](https://discuss.elastic.co/t/how-to-lowercase-a-field-for-creating-index-in-filebeat/221146/1 "2020-02-27T05:36:52Z")

</div>

I am using index template to create dynamic indices,

```
setup.ilm.enabled: false
setup.template.enabled: true
setup.template.name: "testing"
setup.template.pattern: "testing-*"
setup.template.overwrite: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "testing-%{[MessageType]}"

```

The issue is that the field might not return all lowercase characters each time, so is there any way to convert the value of field to lowercase since indices do not accept uppercase characters.

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [February 27, 2020, 9:07am UTC](https://discuss.elastic.co/t/how-to-lowercase-a-field-for-creating-index-in-filebeat/221146/2 "2020-02-27T09:07:26Z")

</div>

Hi!

I would try to process the events and make the field lowercase with [script processor](https://www.elastic.co/guide/en/beats/filebeat/current/processor-script.html).

C.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2020, 9:07am UTC](https://discuss.elastic.co/t/how-to-lowercase-a-field-for-creating-index-in-filebeat/221146/3 "2020-03-26T09:07:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.