Oh, right. Well, you could make an extra round of formatting+parsing, like incoming-message>format-json>lowercase-the-formatted-json>json-parser>format-json, but that would not be too efficient performance-wise.

Or maybe you could use the lowercase function on the incoming message, depending on what it is like.

On Wed, Jan 11, 2017 at 9:46 AM, Fabien Wernli <wernli@in2p3.fr> wrote:

On Wed, Jan 11, 2017 at 09:39:48AM +0100, Fekete, Róbert wrote:
> Actually, in the docs we mention a 'lowercase' template function, I think
> algernon wrote it a few years ago, you can give it a try.

But that will not let you munge the keys, unfortunately

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq