Deprecated: Deprecated in Query Context
Deprecated when used in query context, meant for use in parsers only. For uses in queries please use the lower function. Lower-cases the contents of either or both of the field names or values of a string field.
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
field [a] | array of strings | required | The name of the input field or fields (in [] ) to lowercase. Use the special value as the only field * for ALL fields. When in this mode only the lower-cased fields remain. | |
include | string | optional[b] | values | What to lowercase. |
Valid Values | ||||
both | Convert both the values and field names to lowercase | |||
fields | Convert the field names to lowercase | |||
values | Convert the values of the fields to lowercase | |||
locale | string | optional[b] | The name of the locale to use, as ISO 639 language and an optional ISO 3166 country, such as da , da_DK or en_US . When not specified, uses the system locale. | |
[b] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscale Syntaxlowercase(["value"])
and:
logscale Syntaxlowercase(field=["value"])
These examples show basic structure only.
lowercase()
Examples
With an event with a field Bar=CONTENTS
,
you get contents
in the
Bar
field:
lowercase("Bar")
With an event with a field BAR=CONTENTS
,
you get CONTENTS
in the
bar
field, while
BAR
is still
CONTENTS
.
lowercase("BaR", include="field")
With an event with a field BAR=CONTENTS
,
you get contents
in the
bar
field, while
BAR
is still
CONTENTS
.
lowercase(field=["foo","bar"], include="both")
With an event with a field BAR=CONTENTS
,
you get contents
in the
bar
field, while
BAR
is no longer present.
lowercase(field="*", include="both")