# Lowercase all fields and sub fields

**URL:** <https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438>\
**Category:** Logstash\
**Created:** [March 28, 2019, 9:32pm UTC](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438 "2019-03-28T21:32:30Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 30, 2019, 9:26pm UTC](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438/2 "2019-03-30T21:26:10Z")

</div>

Took a while to figure out this puzzle, but if you create a file containing this script in /home/user/toLower.rb

```auto
def register(params)
    if params['ignore']
        @ignore = params['ignore']
    else
        @ignore = ["path", "@timestamp", "@metadata", "host", "@version"]
    end

end

def processArray(a)
    newArray = []
    a.each { |x|
        newArray << processObject(x)
    }
    newArray
end

def processHash(h)
    newHash = {}
    h.each { |k, v|
        newHash[k.downcase] = processObject(v)
    }
    newHash
end

def processObject(v)
    if v.kind_of?(Array)
        processArray(v)
    elsif v.kind_of?(Hash)
        processHash(v)
    elsif v.kind_of?(String)
        v.downcase
    else
        v
    end
end

def filter(event)
    event.to_hash.each { |k, v|
        unless @ignore.include?(k)
            event.remove(k)
            event.set(k.downcase, processObject(v))
        end
    }
    [event]
end

```

you can call it using

```
 ruby { path => "/home/user/toLower.rb" }

```

It will handle arrays of hashes and hashes of array, data types of boolean, float, integer, string...

There may be other fields that should be ignored by default. Perhaps the stuff added by beats.

Note that it relies on the downcase function of the String class, which in 2.3.3 does not handle accented characters.

---

_[View the full topic](https://discuss.elastic.co/t/lowercase-all-fields-and-sub-fields/174438)._