Tag send to logstash appears in lower case

[Moreth]

Hi!

We got a weird problem, when we sent an event with filebeat that has a tag with lower and uper case, to logstash, in elasticsearch appear as lower case

Filebeat example:

Kibana received:

Thanks a lot

[andrewkroh]

Beats should not be manipulating your tags. It would be helpful to know exactly what configuration (Filebeat and LS) you are running and index templates you are using.

To find out where the problem is you'll have to narrow down to where text is modified. Check the tags value as it leaves and enters each stage in the pipeline.

In Filebeat, enable debug and look at the published events that are written to the logs. (logging.level: debug)

In Logstash, disable filters and add console output. Check the tags. Then re-enable your filters and check the tags again.

output { 
  stdout { 
    codec  => rubydebug {
      metadata => true
    }
  }
}

In Elasticsearch, do you have any normalizers applied in your index template or mapping? It's possible to apply a normalizer that lowercases a field.

[Moreth]

Hi Andrew

Thank you very much! It's a logstash problem after all. I can continue from here thanks to the instructions that you have given me until I find the problem.