Lowercase Field Name

Hi All,

How do I rename a field name so that it is in all lowercase? The field name is utilizing a value from another field (cs2Label is uppercase and I'd like to convert it to lowercase before I rename the field):

mutate {
    rename => { "cs2" => "new_field_%{cs2Label}" }


If I understand correctly, you are using the contents of your field cs2Label, which are uppercase, to rename a field called cs2, and you want the new name to be lowercase.

You could have a mutate{}filter do the lowercase, before your mutate{ rename ...}. Check this out: https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-lowercase

If you need to keep to content of your cs2Label uppercase, simply copy it over to another field, lowercase this new field and use it as suggested above. Then you can remove all superfluous fields.

Hope this helps.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.