Hello there, Im trying to use the lowercase filter but it seens that is not working. I want to apply the filter on "TargetDomainName" field so the results should be "contoso_rt" instead of "CONTOSO_RT" Can someone point me what I´m doing wrong? Here is my config: if [type] == "eventlog" { muta…

It looks like the field is not at the root, so you need to specify it fully, e.g. lowercase => [ "[winlog][event_data][TargetDomainName]" ].

Discuss the Elastic Stack

Mutate lowercase filter not been applied

Elastic Stack Logstash

francescouk (Francesco Ferrari) December 20, 2019, 7:00pm 3

Wow!!! You just saved my day!!!! Thanks for your help!!

Topic		Replies	Views
Mutate Lowercase Issue Logstash	5	1134	June 24, 2021
Logstash - Mutate lowercase doesn't work with filed name Logstash	2	678	June 23, 2020
Adding a copy field and set it lowercase Logstash	3	1904	May 2, 2018
Mutate - Lowercase Logstash	2	2240	July 6, 2017
Convert uppercase in lowercase Logstash	13	15130	July 20, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Mutate lowercase filter not been applied

Related topics