elastic / elastic/beats

[winlogbeat] lowercase and despace/dehyphen all field names before processing

Open
#49,567 1 comment 0 reactions 0 assignees View on GitHub
needs_team
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

**Describe the problem**

Windows logs fields with various diverging field names:

```
IPAddress
IpAddress
Ipaddress
ipAdress
```

```
Win32 Error
win32Error
Win32Error
```

```
Powershell-ID
PowershellID
```
are all real field names that result in separate fields in Elasticsearch.

**Describe the enhancement:**

lowercase all field names and remove spaces (" ") and hyphens ("-") befor processing them. This should significantly cut down on issues with duplicate fields that defy standardization.

**Describe a specific use case for the enhancement or feature:**
Be able to work with more uniform field names.

**Describe drawbacks**
This would be a breaking change that would need refactoring of user dashboards.

See also #48876 #13416

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.