Lowercase

Mutate Elastic Compatible

Synopsis

Converts string values to lowercase.

Schema

- lowercase:
    field: <ident>
    target_field: <ident>
    fields: <string[]>
    exclude: <string[]>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	N	-	Selects value mode: converts the value of this field to lowercase. The value must be a string or an array of strings. Mutually exclusive with fields — when field is set, fields and exclude are ignored
target_field	N	Same as field	Where the converted value is written in value mode. Ignored in name mode
fields	N	["*"]	Selects name mode: glob patterns matching field names to rename to lowercase. The values are left untouched. a.* renames the keys inside object a, *.* those of every root object. Omitting both field and fields renames every root-level field name; names beginning with _ are never renamed
exclude	N	-	Field names to leave alone in name mode. Has no effect in value mode
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if conversion fails
ignore_missing	N	false	Skip processing if referenced field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

Details

The processor can handle both single strings and arrays of strings, applying the transformation to all elements.

The processor is useful for standardizing text fields and tags or categories, prepare fields such as emails addresses for case-insensitive comparisons

note

The processor maintains the original field structure: single strings remain single strings, and arrays remain arrays.

warning

Non-string values in the input field will cause processing errors unless ignore_failure is set to true.

Examples

Basic

Converting a single string...	{ "username": "JohnDoe" } - lowercase: field: username
transforms the element:	{ "username": "johndoe" }

Arrays

Converting an array of strings...	{ "tags": ["User", "Admin", "MANAGER"] } - lowercase: field: tags
transforms all elements:	{ "tags": ["user", "admin", "manager"] }

Keep Original

Storing the result in a new field...	{ "original": "HELLO WORLD" } - lowercase: field: original target_field: lowercase_text
preserves the original:	{ "original": "HELLO WORLD", "lowercase_text": "hello world" }

Conditionals

Using selection criteria...	{ "level": "DEBUG", "should_convert": true } - lowercase: field: level if: "ctx.should_convert == true"
converts only values that meet the condition:	{ "level": "debug", "should_convert": true }

Error Handling

Handling non-string values gracefully...	{ "id": 12345, "name": "USER" } - lowercase: field: id on_failure: - set: field: error value: "Non-string field encountered"
continues the execution:	{ "id": 12345, "name": "USER", "error": "Non-string field encountered" }