Mutate - Lowercase

(Bob) #1

If I try to add a new field based on another existing field, and then make the new field value lowercase I get what looks like an array in my new field and it isn't lowercase.


mutate {
add_field => [ "myindex", "%{cef_DeviceVendor}" ]
lowercase => [ "myindex" ]


"cef_DeviceVendor" => "Microsoft"
"myindex" => [ [0] "Microsoft" ]

OR if I put the lowercase method in it's own mutate filter section, it does convert my new field to lowercase but also converts the original field.


mutate {
add_field => [ "myindex", "%{cef_DeviceVendor}" ]

mutate { lowercase => "myindex" }


"cef_DeviceVendor" => "microsoft"
"myindex" => "microsoft"

Can someone describe to me what I am doing wrong? I simply want to use the value of one field as my Index but it has to be lowercase. I don't want to change the value of the original field as well.

TIA - Bob.

(Magnus B├Ąck) #2

Huh, that's weird. I can confirm this on Logstash 2.1.1. It's like the add_field operation doesn't copy the value of the original field but a reference to it, so that when you downcase the copy the original is affected too.

(system) #3