I can't get my lowercase filter to work :/

Elastic Stack Elasticsearch
1

Hi,

I need to have my @message field not analyzed and also to be lowercased
when stored into ES, the reason is that Kibana can't do proper wildcard
search because of lowercase_expanded_terms. I tried that but it seems that
@message is still not lowercase:

{

  • logstash:
    {
    • order: 0,
    • template: "logstash-*",
    • settings:
      {
      • index.analysis.analyzer.lowercaseonly.type: "custom",
      • index.query.default_field: "@message",
      • index.refresh_interval: "3s",
      • index.analysis.analyzer.lowercaseonly.filter.0: "lowercase",
      • index.analysis.analyzer.lowercaseonly.tokenizer: "keyword"
        },
    • mappings:
      {
      • default:
        {

        • dynamic_templates:
          [

          {
          - string_fields:
          {
          - mapping:
          {
          - index: "analyzed",
          - omit_norms: true,
          - type: "string",
          - fields:
          {
          - raw:
          {
          - index: "not_analyzed",
          - ignore_above: 256,
          - type: "string"
          }
          }
          },
          - match_mapping_type: "string",
          - match: "*"
          }
          }
          ],
        • properties:
          {
          • host:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • received_at:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • @message:
            {
            • index: "not_analyzed",
            • analyzer: "lowercaseonly",
            • type: "string"
              },
          • file:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • thread:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • path:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • class:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • logger_name:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • method:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • gameKey:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • @version:
            {
            • index: "not_analyzed",
            • type: "string"
              },
          • hostname__________:
            {
            • index: "not_analyzed",
            • type: "string"
              }
              },
        • _all:
          {
          • enabled: false
            }
            }
            },
    • aliases: { }
      }

}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/ddc487cb-94f8-449e-af45-e09f12ed7e30%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.