How to make field names lower case when using dynamic mapping

Elastic Stack Logstash
1

Hello,

Is it possible to configure logstash to make all field names lowercase when using dynamic mapping?

Thanks in advance once again,

2

Maybe this will give you some ideas on how to walk through an event modifying it

   ruby {
        init => '
            def doSomething(object, name, keys, event)
                if object
                    if object.kind_of?(Hash) and object != {}
                        object.each { |k, v| doSomething(v, "#{name}[#{k}]", keys, event) }
                    elsif object.kind_of?(Array) and object != []
                        object.each_index { |i|
                            doSomething(object[i], "#{name}[#{i}]", keys, event)
                        }
                        event.remove(name)
                    else
                        event.set(name.downcase, event.remove(name))
                    end
                end
            end
        '
        code => 'event.to_hash.each { |k, v| doSomething(v, "[#{k}]", @field, event) }'
    }

which will take

{ "A": [ {"a": 1}, {"a": 2, "C": 4 } ], "F": { "p": 4, "Q": "5", "r": null }, "ZZ": 1, "zz": 2 }

and turn it into

         "a" => {
    "0" => {
        "a" => 1
    },
    "1" => {
        "a" => 2,
        "c" => 4
    }
},
         "f" => {
    "p" => 4,
    "q" => "5"
},
         "F" => {
    "r" => nil
},
        "zz" => 1

This works depth-first, so it does the wrong things sometimes. It converts the array of hashes "A" into a hash of items with hash values. If fails to downcase [F][r]. You may not like its treatment of some null objects, and you might want to merge zz and ZZ instead of dropping one of them (you could use code from Decorators::add_fields to do that).

It is just intended to provide some ideas....

3

Thanks for this.