如何用Elasticsearch处理器将Filebeat消息中event.action转为小写

我在Elasticsearch DevTools控制台中模拟了以下Ingest Pipeline代码，当前代码通过dissect处理器解析Filebeat消息中的字段，现需将解析得到的event.action字段值（如示例中的Query）转换为小写形式（如query），以得到预期输出。

原模拟代码 #

POST /_ingest/pipeline/_simulate
{
  "pipeline" :
  {
    "description": "_description",
    "processors": [
      {
        "dissect": {
          "field" : "message",
          "pattern" : "%{@timestamp}\t%{->} %{process.thread.id} %{event.action}\t%{message}"
        },
        "set": {
          "field": "event.category",
          "value": "database"
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "message": "2020-10-22T20:28:26.267397Z\t   9 Query\tset session"
      }
    }
  ]
}

修改后的Pipeline代码 #

只需在processors中添加一个lowercase处理器，放在dissect之后（确保先解析出event.action字段再处理）：

POST /_ingest/pipeline/_simulate
{
  "pipeline" :
  {
    "description": "_description",
    "processors": [
      {
        "dissect": {
          "field" : "message",
          "pattern" : "%{@timestamp}\t%{->} %{process.thread.id} %{event.action}\t%{message}"
        }
      },
      {
        "lowercase": {
          "field": "event.action"
        }
      },
      {
        "set": {
          "field": "event.category",
          "value": "database"
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "message": "2020-10-22T20:28:26.267397Z\t   9 Query\tset session"
      }
    }
  ]
}

预期输出 #

{
  "docs" : [
    {
      "doc" : {
        "_index" : "index",
        "_id" : "id",
        "_source" : {
          "process" : {
            "thread" : {
              "id" : "9"
            }
          },
          "@timestamp" : "2020-10-22T20:28:26.267397Z",
          "message" : "set session",
          "event" : {
            "category" : "database",
            "action" : "query"
          }
        },
        "_ingest" : {
          "timestamp" : "2022-08-17T09:27:34.587465824Z"
        }
      }
    }
  ]
}

内容的提问来源于stack exchange，提问作者DevopsDevelop