Deprecated when used in query context, meant for use in parsers only. For uses in queries please use the lower function. Lower-cases the contents of either or both of the field names or values of a string field.
Parameter | Type | Required | Default | Description |
---|---|---|---|---|
field | [string] | true | The name of the input field or fields (in [] ) to lowercase. Use the special value as the only field * for ALL fields. When in this mode only the lower-cased fields remain. | |
include | string | false | values | What to lowercase. One of (values , fields , both ). Defaults to values . If set to fields or both , then the field names are matched against event fields non-case-sensitive, the matching fields names are lower-cased, and the resulting key-value pair added to the event, with the value being lower-cased only for both . |
locale | string | false | The name of the locale to use, as ISO 639 language and an optional ISO 3166 country, such as da , da_DK or en_US . When not specified, uses the system locale. |
Examples
With an event with a field Bar=CONTENTS
, you get
contents
in the Bar
field:
humio
lowercase("Bar")
With an event with a field BAR=CONTENTS
, you get
CONTENTS
in the bar
field, while
BAR
is still CONTENTS
.
humio
lowercase("BaR", include="field")
With an event with a field BAR=CONTENTS
, you get
contents
in the bar
field, while
BAR
is still CONTENTS
.
humio
lowercase(field=["foo","bar"], include="both")
With an event with a field BAR=CONTENTS
, you get
contents
in the bar
field, while
BAR
is no longer present.
humio
lowercase(field="*", include="both")