# Lowercase all fields and sub fields

**URL:** <https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438>\
**Category:** Logstash\
**Created:** [March 28, 2019, 9:32pm UTC](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438 "2019-03-28T21:32:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tellus83](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@tellus83](https://discuss.elastic.co/u/tellus83)\
**Post date:** [March 28, 2019, 9:32pm UTC](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438/1 "2019-03-28T21:32:30Z")

</div>

I'm trying to convert all fields name to lowercase.

This example converts the first fields name but need to convert all sub fields aswell.

```
ruby {
    code => "
        event.to_hash.keys.each do |y|
            event.set(y.downcase, event.remove(y))
        end
    "
}

```

Input:  
[FIRST][SECOND]  
Example result:  
[first][SECOND]  
Wanted result:  
[first][second]

Do anybody know how to get the secound part off the fild name in lowerercase?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 30, 2019, 9:26pm UTC](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438/2 "2019-03-30T21:26:10Z")

</div>

Took a while to figure out this puzzle, but if you create a file containing this script in /home/user/toLower.rb

```auto
def register(params)
    if params['ignore']
        @ignore = params['ignore']
    else
        @ignore = ["path", "@timestamp", "@metadata", "host", "@version"]
    end

end

def processArray(a)
    newArray = []
    a.each { |x|
        newArray << processObject(x)
    }
    newArray
end

def processHash(h)
    newHash = {}
    h.each { |k, v|
        newHash[k.downcase] = processObject(v)
    }
    newHash
end

def processObject(v)
    if v.kind_of?(Array)
        processArray(v)
    elsif v.kind_of?(Hash)
        processHash(v)
    elsif v.kind_of?(String)
        v.downcase
    else
        v
    end
end

def filter(event)
    event.to_hash.each { |k, v|
        unless @ignore.include?(k)
            event.remove(k)
            event.set(k.downcase, processObject(v))
        end
    }
    [event]
end

```

you can call it using

```
 ruby { path => "/home/user/toLower.rb" }

```

It will handle arrays of hashes and hashes of array, data types of boolean, float, integer, string...

There may be other fields that should be ignored by default. Perhaps the stuff added by beats.

Note that it relies on the downcase function of the String class, which in 2.3.3 does not handle accented characters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2019, 9:26pm UTC](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438/3 "2019-04-27T21:26:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.