# How to make field names lower case when using dynamic mapping

**URL:** <https://discuss.elastic.co/t/how-to-make-field-names-lower-case-when-using-dynamic-mapping/360566>\
**Category:** Logstash\
**Created:** [May 30, 2024, 1:59pm UTC](https://discuss.elastic.co/t/how-to-make-field-names-lower-case-when-using-dynamic-mapping/360566 "2024-05-30T13:59:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bvoros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bvoros/32/5246_2.png) [@bvoros](https://discuss.elastic.co/u/bvoros)\
**Post date:** [May 30, 2024, 1:59pm UTC](https://discuss.elastic.co/t/how-to-make-field-names-lower-case-when-using-dynamic-mapping/360566/1 "2024-05-30T13:59:56Z")

</div>

Hello,

Is it possible to configure logstash to make all field names lowercase when using dynamic mapping?

Thanks in advance once again,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 30, 2024, 3:38pm UTC](https://discuss.elastic.co/t/how-to-make-field-names-lower-case-when-using-dynamic-mapping/360566/2 "2024-05-30T15:38:02Z")

</div>

Maybe this will give you some ideas on how to walk through an event modifying it

```
   ruby {
        init => '
            def doSomething(object, name, keys, event)
                if object
                    if object.kind_of?(Hash) and object != {}
                        object.each { |k, v| doSomething(v, "#{name}[#{k}]", keys, event) }
                    elsif object.kind_of?(Array) and object != []
                        object.each_index { |i|
                            doSomething(object[i], "#{name}[#{i}]", keys, event)
                        }
                        event.remove(name)
                    else
                        event.set(name.downcase, event.remove(name))
                    end
                end
            end
        '
        code => 'event.to_hash.each { |k, v| doSomething(v, "[#{k}]", @field, event) }'
    }

```

which will take

```
{ "A": [{"a": 1}, {"a": 2, "C": 4 }], "F": { "p": 4, "Q": "5", "r": null }, "ZZ": 1, "zz": 2 }

```

and turn it into

```
         "a" => {
    "0" => {
        "a" => 1
    },
    "1" => {
        "a" => 2,
        "c" => 4
    }
},
         "f" => {
    "p" => 4,
    "q" => "5"
},
         "F" => {
    "r" => nil
},
        "zz" => 1

```

This works depth-first, so it does the wrong things sometimes. It converts the array of hashes "A" into a hash of items with hash values. If fails to downcase [F][r]. You may not like its treatment of some null objects, and you might want to merge zz and ZZ instead of dropping one of them (you could use code from [Decorators::add\_fields](https://github.com/elastic/logstash/blob/2a7f05975410f68c3e6f7f51297bdac791ee4525/logstash-core/lib/logstash/util/decorators.rb#L28) to do that).

It is just intended to provide some ideas....

---

<div class="post-metadata">

**Author:** ![bvoros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bvoros/32/5246_2.png) [@bvoros](https://discuss.elastic.co/u/bvoros)\
**Post date:** [May 31, 2024, 8:00am UTC](https://discuss.elastic.co/t/how-to-make-field-names-lower-case-when-using-dynamic-mapping/360566/3 "2024-05-31T08:00:28Z")

</div>

Thanks for this.