Deprecated when used in query context, meant for use in parsers only. For uses in queries please use the lower function. Lower-cases the contents of either or both of the field names or values of a string field.

ParameterTypeRequiredDefaultDescription
field[string]true The name of the input field or fields (in []) to lowercase. Use the special value as the only field * for ALL fields. When in this mode only the lower-cased fields remain. [a]
includestringfalsevaluesWhat to lowercase.
  Valid ValuesbothConvert both the values and field names to lowercase
   fieldsConvert the field names to lowercase
  Valid ValuesvaluesConvert the values of the fields to lowercase
localestringfalse The name of the locale to use, as ISO 639 language and an optional ISO 3166 country, such as da, da_DK or en_US. When not specified, uses the system locale.

[a] When you provide only one parameter, the implied parameter is field

Examples

With an event with a field Bar=CONTENTS, you get contents in the Bar field:

humio
lowercase("Bar")

With an event with a field BAR=CONTENTS, you get CONTENTS in the bar field, while BAR is still CONTENTS.

humio
lowercase("BaR", include="field")

With an event with a field BAR=CONTENTS, you get contents in the bar field, while BAR is still CONTENTS.

humio
lowercase(field=["foo","bar"], include="both")

With an event with a field BAR=CONTENTS, you get contents in the bar field, while BAR is no longer present.

humio
lowercase(field="*", include="both")