How to mutate %{[host][hostname]} to lowercase for pipeline output

Elastic Stack Logstash
1

I wanted to create indices with hostnames

EG:

logstash-<hostname>-7.2.0-2019.07.11

My output for the pipeline looks like this

output {
    elasticsearch {
        ssl => true
        hosts => ["xxxxxxx.us-east-1.aws.found.io:xxxx"]
        index => "logstash-%{[host][hostname]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        user => <username>
        password => "<password>"
    }
}

When i run this, it tries to create the indices as below.

logstash-HOSTNAME-7.2.0-2019.07.11

My beats are coming from windows servers, so hostname is in CAPS
as a result of this, logstash is unable to create the indices

"Invalid index name [logstash-HOSTNAME-7.2.0-2019.07.11], must be lowercase" ............

Can someone help on getting this fixed.

2

Found the solution,
i was just dumb

:stuck_out_tongue:

Here is the solution

input {
  beats {
    port => "5044"
    host => "0.0.0.0"
  }
}
filter {
    grok {
	    .............
    }
    mutate {
        lowercase => [ "[host][hostname]" ]
    }
}
output {
    elasticsearch {
        ssl => true
        hosts => ["xxxxxxx.us-east-1.aws.found.io:xxxx"]
        index => "logstash-%{[host][hostname]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        user => <username>
        password => "<password>"
    }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.