# Lowercase hashtag twitter field **URL:** \ **Category:** Logstash\ **Created:** [August 24, 2017, 8:30pm UTC](https://discuss.elastic.co/t/lowercase-hashtag-twitter-field/98290 "2017-08-24T20:30:09Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Singa\_Forever](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@Singa\_Forever](https://discuss.elastic.co/u/Singa_Forever)\ **Post date:** [August 24, 2017, 8:30pm UTC](https://discuss.elastic.co/t/lowercase-hashtag-twitter-field/98290/1 "2017-08-24T20:30:09Z")
Hello, I'm collecting tweets from twitter using ELK 5.X, In order to handle my application, I need to : ``` 1- Convert all collected twitter hashtags to lowercase : ``` I used mutate in logstash file > ``` > filter{ > mutate { > lowercase => [[entities][hashtags][text] ] > } > } > > ``` but this is not working. ( hashtag value text is an element of the object entities.hashtags) waiting for your help, Thank you ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 24, 2017, 8:43pm UTC](https://discuss.elastic.co/t/lowercase-hashtag-twitter-field/98290/2 "2017-08-24T20:43:20Z")
Have you tried doublequoting the field name? ``` lowercase => ["[entities][hashtags][text]" ] ``` If that doesn't help, show what an event looks like. Use a `stdout { codec => rubydebug }` output. ---
**Author:** ![Singa\_Forever](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@Singa\_Forever](https://discuss.elastic.co/u/Singa_Forever)\ **Post date:** [August 24, 2017, 9:25pm UTC](https://discuss.elastic.co/t/lowercase-hashtag-twitter-field/98290/3 "2017-08-24T21:25:49Z")
Hi Magnus, Thank you for your quick answer, I tried using double-quote but nothing new. Output : > { > "extended\_entities" =\> { > "media" =\> [ > [0] { > "display\_url" =\> "", > "source\_user\_id" =\> , > "type" =\> "", > "media\_url" =\> "", > "source\_status\_id" =\> , > "url" =\> "", > "indices" =\> [ > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "source\_status\_id\_str" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > \> "source\_user\_id\_str" =\> "" > }, > [1] { > "display\_url" =\> "", > "source\_user\_id" =\> , > "indices" =\> [ > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "source\_status\_id\_str" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > "source\_user\_id\_str" =\> "" > }, > [2] { > "display\_url" =\> "", > "source\_user\_id" =\> , > "type" =\> "", > "media\_url" =\> "", > "source\_status\_id" =\> , > "url" =\> "", > "indices" =\> [ > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "source\_status\_id\_str" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > "source\_user\_id\_str" =\> "" > }, > [3] { > "display\_url" =\> "", > "source\_user\_id" =\> , > "type" =\> "", > "media\_url" =\> "", > "source\_status\_id" =\> , > "url" =\> "", > "indices" =\> [ > [0] 58, > [1] 81 > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "source\_status\_id\_str" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > "source\_user\_id\_str" =\> "" > } > ] > }, > "in\_reply\_to\_status\_id\_str" =\> nil, > "in\_reply\_to\_status\_id" =\> nil, > "created\_at" =\> "", > "in\_reply\_to\_user\_id\_str" =\> nil, > "source" =\> "", > "retweeted\_status" =\> { > "extended\_entities" =\> { > "media" =\> [ > [0] { > "display\_url" =\> "", > "indices" =\> [ > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > "type" =\> "", > "media\_url" =\> "", > "url" =\> "" > }, > [1] { > "display\_url" =\> "", > "indices" =\> [ > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > "type" =\> "", > "media\_url" =\> "", > "url" =\> "" > }, > [2] { > "display\_url" =\> "", > "indices" =\> [ > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > "type" =\> "", > "media\_url" =\> "", > "url" =\> "" > }, > [3] { > "display\_url" =\> "", > "indices" =\> [ > ], > "sizes" =\> { > }, > "id\_str" =\> "", > "expanded\_url" =\> "", > "media\_url\_https" =\> "", > "id" =\> , > "type" =\> "", > "media\_url" =\> "", > "url" =\> "" > } > ] > }, > "in\_reply\_to\_status\_id\_str" =\> nil, > "in\_reply\_to\_status\_id" =\> nil, > "created\_at" =\> "", > "in\_reply\_to\_user\_id\_str" =\> nil, > "source" =\> "", > "retweet\_count" =\> 5, > "retweeted" =\> false, > "geo" =\> nil, > "filter\_level" =\> "", > "in\_reply\_to\_screen\_name" =\> nil, > "is\_quote\_status" =\> false, > "id\_str" =\> "", > "in\_reply\_to\_user\_id" =\> nil, > "favorite\_count" =\> 10, > "id" =\> , > "text" =\> "", > "place" =\> nil, > "lang" =\> "und", > "favorited" =\> false, > "possibly\_sensitive" =\> false, > "coordinates" =\> nil, > "truncated" =\> false, > "entities" =\> { > "urls" =\> , > "hashtags" =\> [ > [0] { > "indices" =\> [ > [0] 24, > [1] 27 > ], > "text" =\> "F1" > }, > ..... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 25, 2017, 5:12am UTC](https://discuss.elastic.co/t/lowercase-hashtag-twitter-field/98290/4 "2017-08-25T05:12:16Z")
`[entities][hashtags][text]` isn't a valid field reference since `[entities][hashtags]` is an array. Two options: - If `[entities][hashtags]` never contains more than one element you can use `[entities][hashtags][0][text]` to reference the `text` subfield of the first element. - If you want to lowercase all `text` subfields of all elements of the `[entities][hashtags]`array you'll have to use a ruby filter. The lowercase feature does support iterating over the elements of an array, but only arrays of strings. Arrays of objects aren't supported. ---
**Author:** ![Singa\_Forever](https://avatars.discourse-cdn.com/v4/letter/s/898d66/32.png) [@Singa\_Forever](https://discuss.elastic.co/u/Singa_Forever)\ **Post date:** [August 25, 2017, 1:28pm UTC](https://discuss.elastic.co/t/lowercase-hashtag-twitter-field/98290/5 "2017-08-25T13:28:38Z")
The solution is using ruby filter. Thank you so much. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 22, 2017, 1:28pm UTC](https://discuss.elastic.co/t/lowercase-hashtag-twitter-field/98290/6 "2017-09-22T13:28:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.