I am importing IIS logs from the SMTP relay service. I have successfully separated out all of the fields in logstash. One of the data fields needs to have excess characters trimmed and then converted to lower case for the report grouping to display correctly.
The field name is cs-uri-query and it contains data like this:
I want to retrieve the email address and convert it to lower case.
I would appreciate some code to try or a link that describes the process.