Why elasticsearch convert all my field name to lower case?

hello,

i create the following index :

PUT testindex 
{
  "mappings": {
    "datai": { 
      "properties": { 
        "firsName": { "type": "text"  }, 
	    "lastName":       { "type": "text"  },
        "phoneNumber":       { "type": "text"  }			
      }
    }
  }
}

and i want the "N" letter in upper case , but when i got my data from a DB using logstash , elasticsearch convert all my field name to lower case , is this normal ?

this the result when i try to get data :

{
	"_index": "testindex",
	"_type": "datai",
	"_id": "12",
	"_version": 1,
	"found": true,
		"_source": {
		"firstname": "my firstname",
		"lastname": "my lastname",
		"phonenumber": "0989888",
		"@version": "1",
		"@timestamp": "2018-06-05T10:41:18.098Z"
		}
}

ther is any tips to force elasticsearch to respect my fileds name ?

this my sql query executed by logstash (i'm using oracle DB:

select firstname "firsName", lastname "lastName", phonenumber "phoneNumber" from my table

Elasticsearch never alters the _source field. Which means that Logstash basically sent something like:

{
	"firstname": "my firstname",
	"lastname": "my lastname",
	"phonenumber": "0989888",
	"@version": "1",
	"@timestamp": "2018-06-05T10:41:18.098Z"
}

Probably something to solve on Logstash side.

thank you for your response , do you have any idea on how to resolve this on Logstash Side ?

No. I don't know what you did.

I solve the problem by renaming my fileds in logstash filter

filter {
  mutate {
  
	rename => {
				  "firstname" => "firsName"
				  "lastname" => "lastName"
				  "phonenumber" => "phoneNumber"
				
         }
	
  }
}

good luck

But can you share your input part of the logstash configuration?
The problem you described might indicate a bug.

i follow this tutorial : https://www.elastic.co/blog/logstash-jdbc-input-plugin

But I don't see UpperCase / LowerCase SELECT clauses in logstash configurations there.

So again, please share your Logstash configuration.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.