Kibana 5.3.2 case sensitive


How do I make a field case insensitive?

I have a saved search that gets all delivered Exchange email messages. However, when I come to Visualize (vertical bar chart) this it shows recipients as separate entities i.e. and' are different columns.

Is there someway to combine them into one column?

You need to do this via Elasticsearch's analyser capabilities, which needs to be setup before indexing.

Thanks. Would this be the correct syntax?

POST _analyze
  "analyzer": "simple",
  "text": recipient_address, sender_address


The simple analyser may break on the @, but you have the right idea to test :slight_smile:

Once you have an analyser you are after you need to add that to a mapping/template so it is auto applied.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.