Fields that contain protocol names like should have normalized capitalization

[webmat]

I think lowecase would make sense. Thoughts?

Fields in question:

• network.transport
• network.type
• network.application
• network.protocol

[webmat]

Ping @andrewkroh @adriansr

[adriansr]

+1 to lowercase

[MikePaquette]

+1 for normalizing case of these fields to lowercase. This is related to #220 where this restriction could be included in a validation column in the ECS specification, perhaps with Regex for the check.

[andrewkroh]

Applying a normalizer in the generated template would be a nice addition because it would normalize both the ingested data and the search queries from users.

[ruflin]

I like this idea. We could make this as part of our template.

@andrewkroh Could you open a separate GIthub issue with this idea?

[andrewkroh]

I created #260.