Logstash - Mutate lowercase doesn't work with filed name

Elastic Stack Logstash
1

Hello,

I'm trying to unify some of our fields to be the same case. Now we have TARGET_INDEX and target_index

I have tried to apply mutate lowercase filter as described in the documentation:

mutate {
    lowercase => ["TARGET_INDEX"]
    # rename => { "TARGET_INDEX" => "target_index" }
    remove_field => ["tags", "@version"]
}

On the output and also in the index I see an uppercase field. When I use rename it works as expected - I see it in the output and in the index.

This mutate is the first in the list of filters. Why lowercase may not work?

Logstash version: logstash 7.0.1

Thank you!

2

Hi,

lowercase works with values, it won't change field names.
As you have already tested, rename is the option you need.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.