Lower case all fields

Elastic Stack Elasticsearch
1

hello :blush:
I want to create visualizations on lowercase fields.
Text type can not work because it can be aggerated.
example:
I want to create a visualization that shows the top ten process.executable but i want to make sure that all the process.executable are in lowercase. c:\temp\virus.exe and c:\temp\Virus.exe is the same for me.
how can i do it on all the fields in my index???

2

Hey @han_fatzot !

If you want to lowercase your keyword fields, you can use normalizers for that. It allows you to use an analyzer-like chain for keyword values.

Hope that helps!

3

how to do it on all my fields without writing on every field with normalizer??
how to do it in index template??

4

You could use dynamic templates for that, something similar to:

PUT my-index
{
  "settings": {
     ...
  },
  "mappings": {
    "dynamic_templates": [
      {
        "strings": {
          "match_mapping_type": "string",
          "mapping": {
            "type": "keyword",
            "ignore_above": 256,
            "normalizer": "my-normalizer"
          }
        }
      }
    ]
  }
}

That would match all string fields that don't exist already in the mapping and use a keyword with a specific normalizer for mapping them.

5

how to do it on already mapped fields?

6

I would recommend reindexing into a new index that already have the dynamic mapping.

7

but i have default mapping in my mapping template so if i do it in the dynamic mapping. will it change all the fields? also the fields that are mapped

8

@Carlos_D

9

Once your mapping is created for a field, it won't change using dynamic mapping. You need to reindex into a different index with that dynamic template mapping to apply it.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.