# How to mutate %{\[host\]\[hostname\]} to lowercase for pipeline output

**URL:** <https://discuss.elastic.co/t/how-to-mutate-host-hostname-to-lowercase-for-pipeline-output/190116>\
**Category:** Logstash\
**Created:** [July 11, 2019, 10:06pm UTC](https://discuss.elastic.co/t/how-to-mutate-host-hostname-to-lowercase-for-pipeline-output/190116 "2019-07-11T22:06:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thanura\_Kannangara](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\
**Post date:** [July 11, 2019, 10:06pm UTC](https://discuss.elastic.co/t/how-to-mutate-host-hostname-to-lowercase-for-pipeline-output/190116/1 "2019-07-11T22:06:02Z")

</div>

I wanted to create indices with hostnames

EG:

```
logstash-<hostname>-7.2.0-2019.07.11

```

My output for the pipeline looks like this

```
output {
    elasticsearch {
        ssl => true
        hosts => ["xxxxxxx.us-east-1.aws.found.io:xxxx"]
        index => "logstash-%{[host][hostname]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        user => <username>
        password => "<password>"
    }
}

```

When i run this, it tries to create the indices as below.

```
logstash-HOSTNAME-7.2.0-2019.07.11

```

My beats are coming from windows servers, so hostname is in CAPS  
as a result of this, logstash is unable to create the indices

```
"Invalid index name [logstash-HOSTNAME-7.2.0-2019.07.11], must be lowercase" ............

```

Can someone help on getting this fixed.

---

<div class="post-metadata">

**Author:** ![Thanura\_Kannangara](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\
**Post date:** [July 11, 2019, 10:48pm UTC](https://discuss.elastic.co/t/how-to-mutate-host-hostname-to-lowercase-for-pipeline-output/190116/2 "2019-07-11T22:48:32Z")

</div>

Found the solution,  
i was just dumb

😛

Here is the solution

```
input {
  beats {
    port => "5044"
    host => "0.0.0.0"
  }
}
filter {
    grok {
	    .............
    }
    mutate {
        lowercase => ["[host][hostname]" ]
    }
}
output {
    elasticsearch {
        ssl => true
        hosts => ["xxxxxxx.us-east-1.aws.found.io:xxxx"]
        index => "logstash-%{[host][hostname]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        user => <username>
        password => "<password>"
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2019, 10:48pm UTC](https://discuss.elastic.co/t/how-to-mutate-host-hostname-to-lowercase-for-pipeline-output/190116/3 "2019-08-08T22:48:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.