[winlogbeat] lowercase and despace/dehyphen all field names before processing
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
**Describe the problem**
Windows logs fields with various diverging field names:
```
IPAddress
IpAddress
Ipaddress
ipAdress
```
```
Win32 Error
win32Error
Win32Error
```
```
Powershell-ID
PowershellID
```
are all real field names that result in separate fields in Elasticsearch.
**Describe the enhancement:**
lowercase all field names and remove spaces (" ") and hyphens ("-") befor processing them. This should significantly cut down on issues with duplicate fields that defy standardization.
**Describe a specific use case for the enhancement or feature:**
Be able to work with more uniform field names.
**Describe drawbacks**
This would be a breaking change that would need refactoring of user dashboards.
See also #48876 #13416
Contributor guide
Assessment
This issue has not been assessed yet.