Lowercase keys after key_value

[nisow95612]

Hello Graylog community,

today I want to share a question that I hoped to be simple, but I am failing to find a solution.
The question stands: Is there a way to lowercase keys in a map, e.g. output of key_value()?

My goal is to convert input like (KeyOne=Server, Username=OneUSER) into lowercase fields `{“keyone”: “Server”, “username”: “OneUSER”}```?

I find it strange that I found no way to transform maps. I imagine something like converting the map to an array of keys and array of values, running a regex/lowercase on keys and then merging them back to map… Or just export keys, transform them and re-import?

Right now I worked this around by creating a lot of rules that replace common key names by their lowercase variants like when has_field("KeyOne") && !has_field("keyone") then rename_field("KeyOne","keyone"); end, but I would be surprised if that wasn’t horribly inefficient.

[gsmith]

Hello @nisow95612

@nisow95612

My goal is to convert input like (KeyOne=Server, Username=OneUSER) into lowercase fields `{“keyone”: “Server”, “username”: “OneUSER”}```?

I see, you want the fields to be all lower case. To be honest I haven’t see this done but maybe someone else has.

The only thing I can think of at this point is maybe create a custom index mapping but I havent done that yet.