Mutate Lowercase Issue

Elastic Stack Logstash
1

Hi,

I'm running Logstash 7.3 and I actually face an issue (or maybe I didn't write the filter correctly) when I apply a lowercase to a new field. The base field is always lowered too.

First, I tried this:

	filter {
		mutate {
			copy => {
				"plant" => "plantLowerCase"
			}
		}           
		
		mutate {
			lowercase => ["plantLowerCase"]
		}
	}

Then, I tried this:

    filter {
    	mutate {
    		add_field => { 
    			"plantLowerCase" => "%{plant}"
    		}
    	}
    	
    	mutate {
    		lowercase => ["plantLowerCase"]
    	}
    }

Both plant and plantLowerCase are getting lowered.

What am I missing?

Regards,
Alexandre

2

I am unable to reproduce this

input { generator { count => 1 lines => [ '' ] } }
filter {
    mutate { add_field => { "[plant]" => "alfa rOMEO" } }
    mutate { copy => { "plant" => "plantLowerCase" } }
    mutate { lowercase => ["plantLowerCase"] }
}
output  { stdout { codec => rubydebug { metadata => false } } }

produces

         "plant" => "alfa rOMEO",
"plantLowerCase" => "alfa romeo",

This is on 7.13.0.

3

Hi Badger!

Thanks for the reply.

I tried with your code and yep, it works. But the difference is that you create both field in the filter.

I've try something like this and I have the issue:

input { 
	generator
	 {
		lines => [
			'{"id":1, "plant":"CHEvY"}'
		]
		count => 1
		codec => "json"
	 } 
 }
filter {
    mutate { copy => { "plant" => "plantLowerCase" } }
    mutate { lowercase => ["plantLowerCase"] }
}
output  {
	file {
		path => "./test-%{+HH.mm}.txt"
	}
}

In the output file, I get something like this:

{"sequence":0,"plantLowerCase":"chevy","@version":"1","@timestamp":"2021-05-27T19:18:27.934Z","host":"SRV-ANALYTICS","plant":"chevy","id":1}

Regards,
Alexandre

4

Interesting. My guess is you are hitting the problem that this PR fixes. It shipped in 7.12.1.

If you cannot upgrade then the lowercase function is small enough that you could do it in a ruby filter.

5

Good!

I will do it in a ruby filter.

Thanks for your support!

Have a nice day :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.