This simple query function may be used to change the text given, by way of a field from an event or otherwise, to all upper-case letters. This is based on the presumed language, but you can set the language and locale if needed.

ParameterTypeRequiredDefaultDescription
asstringfalse_upperThe name of the output field.
fieldstringtrue The name of the input field with the value to convert to upper-case. [a]
localestringfalse The name of the locale to use as ISO 639 language and an ISO 3166 country. When not specified, uses the system locale.

[a] When you provide only one parameter, the implied parameter is field

For the value of type, you can specify just the language, or you can refine that choice by including the country. For instance, you might specify en for English. You could be more specific by entering en_UK for U.K. English or en_US for U.S. English. Choosing the right language is perhaps most important when data includes text in other languages like Russian with Cyrillic letters.

Examples

As a simple example, suppose you have two fields that you want to concatenate together, but want to set one to all lower-case letters and the other to all upper-case letters. You might do that using the concat() function, along with the lower() and upper() query functions, like so:

humio
lower(@error_msg[0], as=msg1) |
upper(@error_msg[1], as=msg2) |
concat([msg1, msg2], as=test)

In this query, the as parameter was used for the lower() and for the upper() query functions to label their results. Those field names are then used with the concat() function. That wasn't necessary, though. They could have be referenced by the default names, _lower and _upper. The specific labeling, though, is particularly useful when you have more than one field that use the same query function.

The screenshot shown in Figure 1 shows the results of the query above.

upper() Example

Figure 284. upper() Example


One of the events is selected. Notice the text of the message is in lower-case letters, for the first part, and the second message is in upper-case — that part is highlighted in blue in the screenshot.