elastic / elastic/ecs

Apply lowercase normalizer to certain keyword fields in template

Open
#260 4 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

By applying a [lowercase normalizer](https://www.elastic.co/guide/en/elasticsearch/reference/current/normalizer.html) to keyword fields the value will be lowercased in indexing time as well as at search-time. This helps if, for example, an application writes `network.type` as `IPv4` or if a user queries for `IPV4`.

I think it makes sense to apply this to fields where case-sensitivity doesn't matter.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.