# Tag send to logstash appears in lower case

**URL:** <https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 28, 2018, 7:30am UTC](https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757 "2018-06-28T07:30:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moreth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moreth/32/32760_2.png) [@Moreth](https://discuss.elastic.co/u/Moreth)\
**Post date:** [June 28, 2018, 7:30am UTC](https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757/1 "2018-06-28T07:30:51Z")

</div>

Hi!

We got a weird problem, when we sent an event with filebeat that has a tag with lower and uper case, to logstash, in elasticsearch appear as lower case

Filebeat example:  
 ![screenshot](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76fcc6f11cf15f39fbc944a99291252550ee15e2.png)

Kibana received:  
 ![screenshot](https://us1.discourse-cdn.com/elastic/original/3X/0/5/05d057f9c375a3490a6d4f630960b28a40cf7a32.png)

Thanks a lot

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 28, 2018, 6:11pm UTC](https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757/2 "2018-06-28T18:11:23Z")

</div>

Beats should not be manipulating your tags. It would be helpful to know exactly what configuration (Filebeat and LS) you are running and index templates you are using.

To find out where the problem is you'll have to narrow down to where text is modified. Check the `tags` value as it leaves and enters each stage in the pipeline.

In Filebeat, enable debug and look at the published events that are written to the logs. (`logging.level: debug`)

In Logstash, disable filters and add console output. Check the `tags`. Then re-enable your filters and check the `tags` again.

```auto
output { 
  stdout { 
    codec => rubydebug {
      metadata => true
    }
  }
}

```

In Elasticsearch, do you have any [normalizers](https://www.elastic.co/guide/en/elasticsearch/reference/current/normalizer.html) applied in your index template or mapping? It's possible to apply a normalizer that lowercases a field.

---

<div class="post-metadata">

**Author:** ![Moreth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moreth/32/32760_2.png) [@Moreth](https://discuss.elastic.co/u/Moreth)\
**Post date:** [June 29, 2018, 7:16am UTC](https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757/4 "2018-06-29T07:16:17Z")

</div>

Hi Andrew

Thank you very much! It's a logstash problem after all. I can continue from here thanks to the instructions that you have given me until I find the problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2018, 7:16am UTC](https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757/5 "2018-07-27T07:16:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.