Deprecated when used in query context, meant for use in parsers only. For uses in queries please use the lower function. Lower-cases the contents of either or both of the field names or values of a string field.

ParameterTypeRequiredDefaultDescription
field[string]true The name of the input field or fields (in []) to lowercase. Use the special value as the only field * for ALL fields. When in this mode only the lower-cased fields remain.
includestringfalsevaluesWhat to lowercase. One of (values, fields, both). Defaults to values. If set to fields or both, then the field names are matched against event fields non-case-sensitive, the matching fields names are lower-cased, and the resulting key-value pair added to the event, with the value being lower-cased only for both.
localestringfalse The name of the locale to use, as ISO 639 language and an optional ISO 3166 country, such as da, da_DK or en_US. When not specified, uses the system locale.

Examples

With an event with a field Bar=CONTENTS, you get contents in the Bar field:

humio
lowercase("Bar")

With an event with a field BAR=CONTENTS, you get CONTENTS in the bar field, while BAR is still CONTENTS.

humio
lowercase("BaR", include="field")

With an event with a field BAR=CONTENTS, you get contents in the bar field, while BAR is still CONTENTS.

humio
lowercase(field=["foo","bar"], include="both")

With an event with a field BAR=CONTENTS, you get contents in the bar field, while BAR is no longer present.

humio
lowercase(field="*", include="both")