# Mutate Lowercase Issue

**URL:** <https://discuss.elastic.co/t/mutate-lowercase-issue/274247>\
**Category:** Logstash\
**Created:** [May 27, 2021, 6:07pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247 "2021-05-27T18:07:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandre.Bernier](https://avatars.discourse-cdn.com/v4/letter/a/e8c25b/32.png) [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\
**Post date:** [May 27, 2021, 6:07pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247/1 "2021-05-27T18:07:55Z")

</div>

Hi,

I'm running Logstash 7.3 and I actually face an issue (or maybe I didn't write the filter correctly) when I apply a **lowercase** to a **new field**. The **base field** is always lowered too.

First, I tried this:

```auto
	filter {
		mutate {
			copy => {
				"plant" => "plantLowerCase"
			}
		}           
		
		mutate {
			lowercase => ["plantLowerCase"]
		}
	}

```

Then, I tried this:

```auto
    filter {
    	mutate {
    		add_field => { 
    			"plantLowerCase" => "%{plant}"
    		}
    	}
    	
    	mutate {
    		lowercase => ["plantLowerCase"]
    	}
    }

```

Both **plant** and **plantLowerCase** are getting lowered.

What am I missing?

Regards,  
Alexandre

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 27, 2021, 6:30pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247/2 "2021-05-27T18:30:42Z")

</div>

I am unable to reproduce this

```
input { generator { count => 1 lines => [''] } }
filter {
    mutate { add_field => { "[plant]" => "alfa rOMEO" } }
    mutate { copy => { "plant" => "plantLowerCase" } }
    mutate { lowercase => ["plantLowerCase"] }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

produces

```
         "plant" => "alfa rOMEO",
"plantLowerCase" => "alfa romeo",

```

This is on 7.13.0.

---

<div class="post-metadata">

**Author:** ![Alexandre.Bernier](https://avatars.discourse-cdn.com/v4/letter/a/e8c25b/32.png) [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\
**Post date:** [May 27, 2021, 7:21pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247/3 "2021-05-27T19:21:36Z")

</div>

Hi Badger!

Thanks for the reply.

I tried with your code and yep, it works. But the difference is that you create both field in the filter.

I've try something like this and I have the issue:

```auto
input { 
	generator
	 {
		lines => [
			'{"id":1, "plant":"CHEvY"}'
		]
		count => 1
		codec => "json"
	 } 
 }
filter {
    mutate { copy => { "plant" => "plantLowerCase" } }
    mutate { lowercase => ["plantLowerCase"] }
}
output {
	file {
		path => "./test-%{+HH.mm}.txt"
	}
}

```

In the output file, I get something like this:

```auto
{"sequence":0,"plantLowerCase":"chevy","@version":"1","@timestamp":"2021-05-27T19:18:27.934Z","host":"SRV-ANALYTICS","plant":"chevy","id":1}

```

Regards,  
Alexandre

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 27, 2021, 7:42pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247/4 "2021-05-27T19:42:40Z")

</div>

Interesting. My guess is you are hitting the problem that [this](https://github.com/logstash-plugins/logstash-filter-mutate/pull/151/commits/8bc0b4fef26a90772f8efddfa9066cae32a1560c) PR fixes. It shipped in 7.12.1.

If you cannot upgrade then the [lowercase function](https://github.com/logstash-plugins/logstash-filter-mutate/blob/9d691111049a10e45d83155497eb8a6778aa3f45/lib/logstash/filters/mutate.rb#L436) is small enough that you could do it in a ruby filter.

---

<div class="post-metadata">

**Author:** ![Alexandre.Bernier](https://avatars.discourse-cdn.com/v4/letter/a/e8c25b/32.png) [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\
**Post date:** [May 27, 2021, 7:46pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247/5 "2021-05-27T19:46:09Z")

</div>

Good!

I will do it in a ruby filter.

Thanks for your support!

Have a nice day 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2021, 7:46pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247/6 "2021-06-24T19:46:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.