lowercase( ) Query Function

Deprecated when used in query context, meant for use in parsers only. For uses in queries please use the lower function. Lower-cases the contents of either or both of the field names or values of a string field.

Parameters

Name Type Required Default Description
field [string] Yes The name of the input field or fields (in []) to lowercase. Use the special value as the only field * for ALL fields. When in this mode only the lower-cased fields remain.
locale string No The name of the locale to use, as ISO 639 language and an optional ISO 3166 country, such as ‘da’,‘da_DK’ or ‘en_US’. When not specified, uses the system locale
include string No values What to lowercase. One of (‘values’, ‘fields’, ‘both’). Defaults to ‘values’. If set to ‘fields’ or ‘both’, then the ‘field’ names are matched against event fields non-case-sensitive, the matching fields names are lower-cased, and the resulting key-value pair added to the event, with the value being lower-cased only for ‘both’.

field is the unnamed parameter.

Examples

With an event with a field “Bar=CONTENTS”, you get ‘contents’ in the ‘Bar’ field

lowercase("Bar")

With an event with a field “BAR=CONTENTS”, you get ‘CONTENTS’ in the ‘bar’ field, while BAR is still CONTENTS.

lowercase("BaR", include="field")

With an event with a field “BAR=CONTENTS”, you get ‘contents’ in the ‘bar’ field, while BAR is still CONTENTS.

lowercase(field=["foo","bar"], include="both")

With an event with a field “BAR=CONTENTS”, you get ‘contents’ in the ‘bar’ field, while BAR is no longer present.

lowercase(field="*", include="both")