Kibana 5.3.2 case sensitive

[teejayuu]

Hi

How do I make a field case insensitive?

Example
I have a saved search that gets all delivered Exchange email messages. However, when I come to Visualize (vertical bar chart) this it shows recipients as separate entities i.e. My.Name@domain.com and my.name'domain.com are different columns.

Is there someway to combine them into one column?
Thanks
Tony

[warkolm (Mark Walkom)]

You need to do this via Elasticsearch's analyser capabilities, which needs to be setup before indexing.

[teejayuu]

@warkolm

need to do this via Elasticsearch's analyser capabilities, which needs to be setup before indexing

Thanks. Would this be the correct syntax?

POST _analyze
{
  "analyzer": "simple",
  "text": recipient_address, sender_address
}

Tony

[warkolm (Mark Walkom)]

The simple analyser may break on the @, but you have the right idea to test

Once you have an analyser you are after you need to add that to a mapping/template so it is auto applied.