Title case conversion in logstash filter-mutate

[sujeetKumar]

Env- Elastic 5.5

Requirement: For Kibana Region map, Country Name is required in Title case.

So, I can do this in logstash. I have tried below statement:

filter
{
mutate {
gsub => [
# replace all first character of word with uppercase(Title Case)
"affected country", "(\w)(\w+)", "\U$1\L$2"
]
}
}

But I am getting output as \U$1\L$2 \U$1\L$2 which is a regex converted to string

Any suggestion how to achieve this

[paz]

You can use Ruby's capitalize method to avoid regex patterns, like so:

filter {
    ruby {
        code => "
            event.set('affected country', event.get('affected country').capitalize)
        "
    }
}

[sujeetKumar]

This statement will capitalize all the characters. I want title case . for example:

"i want a title case conversion of sentence."
to
"I Want A Title Case Conversion Of Sentence."

Because, Kibana country names for region map is required in such format.
It won't accept "united kingdom" OR "UNITED KINGDOM".
So, I need to convert it as "United Kingdom".

We can do this with Kibana scripted fields. But that is not working with Region Map.

[paz]

Ruby's capitalize surely does not make uppercase all characters (example) . I also tested it in Logstash 5.6.5 and it works as intended. What version of Logstash are you using?

Anyhow, if you want to capitalize each word in a sentence and not a single word, use this.

filter {
    ruby {
        code => "
            event.set('affected country', event.get('affected country').split(' ').map(&:capitalize).join(' '))
        "
    }
}

[sujeetKumar]

Yeah Paz, It worked like a charm. I think i need to get more deep in ruby queries. Thank you very much.

[Karthik_Saravanan]

How to put field name in this script?

[sujeetKumar]

@paz

affected country

Like I kept "affected country"