ecs lowercase normalizer for host.name about ecs

[ruflin]

I remember we just had recently a discussion around this in Beats. Here is one related issue: elastic/beats#7534 but there was also an other I couldn't find.

I don't think it should be up to ECS to have a convention here as there are definitively use cases where users want to have the case sensitive hostname. Instead it would be nice if this could be done on query time.

[willemdh]

it would be nice if this could be done on query time

What do you mean with this? Like a Beat processor? Personally I like the normalizer better, as the data in Elasticsearch matches the real situation.

I don't think it should be up to ECS to have a convention here as there are definitively use cases where users want to have the case sensitive hostname

I'll keep using my Beat override template then

[ruflin]

On query time I mean that even if we have hoSt.local and Host.local in the index, someone could write a query just for host.local and get both results, but I don't think this is possible.