Mutate lowercase example uses array/list

Elastic Stack Logstash
1

Hello,

Concerning

In the example it tells you to use a list as the argument. However that makes a list out of what might just be a string.

In my case what worked as expected is:

add_field => {
  "qname_lc" => "%{qname}"
}
lowercase => "qname_lc"

Not

lowercase => [ "qname_lc" ]

which added brackets that I do not need in the result.

Any idea why there are square brackets in the example?

Thanks.

2

Because the lowercase option takes an array of field names, so that you can lowercase more than one field. If you supply a single field name then logstash will happily convert it to an array for you.

Note that add_field happens after all the other mutate options, so to add a field and then lowercase it you will need to use separate mutate filters for each operation.