So, I learned something the hard way today and thought I would share. I'm sure most of you already knew this but here goes.
It turns out that, while you can use message field names with dashes in them (e.g. cs-host) you cannot perform Stellar operations with them. In my case, this was a field transformation but I'm assuming it would apply to other uses of Stellar as well. Looking at it after the fact, it makes a lot more sense, but it took me a while to realize that the dashes in the field name were being treated as a minus in Stellar, thus returning zero for the string operations I was trying to perform. Example field transform config: "fieldTransformations": [ { "transformation": "STELLAR", "output": ["proto"], "config": { "proto": "TO_UPPER(cs-uri-scheme)" } } ] Example message: { "cs-host": "crl.microsoft.com", "cs-uri-scheme": "http", "s-action": "TCP_HIT", "timestamp": 1491759661030, "proto": "0" ... } My solution, change the field names to not contain dashes and everything works as expected :). Lesson learned; read the docs carefully. It clearly states in the README that '-' is a reserved keyword. Sharing this to save someone else like me a little time. -Kyle