lowercase() Query Function

Deprecated when used in query context, meant for use in parsers only. For uses in queries please use the lower function. Lower-cases the contents of either or both of the field names or values of a string field.

Parameters

Name

Type

Required

Default

Description

field

[string]

Yes

The name of the input field or fields (in []) to lowercase. Use the special value as the only field * for ALL fields. When in this mode only the lower-cased fields remain.

locale

string

No

The name of the locale to use, as ISO 639 language and an optional ISO 3166 country, such as da, da_DK or en_US. When not specified, uses the system locale.

include

string

No

values

What to lowercase. One of (values, fields, both). Defaults to values. If set to fields or both, then the field names are matched against event fields non-case-sensitive, the matching fields names are lower-cased, and the resulting key-value pair added to the event, with the value being lower-cased only for both.

The implied parameter is field.

Examples

With an event with a field Bar=CONTENTS, you get contents in the Bar field:

humio
lowercase("Bar")

With an event with a field BAR=CONTENTS, you get CONTENTS in the bar field, while BAR is still CONTENTS.

humio
lowercase("BaR", include="field")

With an event with a field BAR=CONTENTS, you get contents in the bar field, while BAR is still CONTENTS.

humio
lowercase(field=["foo","bar"], include="both")

With an event with a field BAR=CONTENTS, you get contents in the bar field, while BAR is no longer present.

humio
lowercase(field="*", include="both")