Mutate - Lowercase

Elastic Stack Logstash
1

If I try to add a new field based on another existing field, and then make the new field value lowercase I get what looks like an array in my new field and it isn't lowercase.

FILTER:

mutate {
add_field => [ "myindex", "%{cef_DeviceVendor}" ]
lowercase => [ "myindex" ]
}

STDOUT:

"cef_DeviceVendor" => "Microsoft"
"myindex" => [ [0] "Microsoft" ]

===============
OR if I put the lowercase method in it's own mutate filter section, it does convert my new field to lowercase but also converts the original field.

FILTERS:

mutate {
add_field => [ "myindex", "%{cef_DeviceVendor}" ]
}

mutate { lowercase => "myindex" }

STDOUT:

"cef_DeviceVendor" => "microsoft"
"myindex" => "microsoft"

=============
Can someone describe to me what I am doing wrong? I simply want to use the value of one field as my Index but it has to be lowercase. I don't want to change the value of the original field as well.

TIA - Bob.

2

Huh, that's weird. I can confirm this on Logstash 2.1.1. It's like the add_field operation doesn't copy the value of the original field but a reference to it, so that when you downcase the copy the original is affected too.