I have deployed Elasticsearch 7.7.1-1, Logstash 7.7.1-1 and Kibana 7.7.1-1. I am shipping logs to Logstash using Filebeat.
I am developing a query to parse the request field of the apache logs. I have noticed there is a request.keyword field, a rawrequest and a rawrequest.keyword field but they don't seem to be populated. The problem I'm having is that the URL contains capital letters and any query I author that contains any of the letters (For Example: TEST or test) fails to match.
I don't know if either is normal behavior (the fact that the fields are empty and that even non case sensitive queries are failing to match).
Thanks in Advance.