# 5.2.2 and netflow codec: IP addresses appear as strings

**URL:** <https://discuss.elastic.co/t/5-2-2-and-netflow-codec-ip-addresses-appear-as-strings/78904>\
**Category:** Logstash\
**Created:** [March 16, 2017, 4:17pm UTC](https://discuss.elastic.co/t/5-2-2-and-netflow-codec-ip-addresses-appear-as-strings/78904 "2017-03-16T16:17:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bergante](https://avatars.discourse-cdn.com/v4/letter/b/8797f3/32.png) [@Bergante](https://discuss.elastic.co/u/Bergante)\
**Post date:** [March 16, 2017, 4:17pm UTC](https://discuss.elastic.co/t/5-2-2-and-netflow-codec-ip-addresses-appear-as-strings/78904/1 "2017-03-16T16:17:28Z")

</div>

Hi

I have just installed the ELK 5.2.2 suite. It's running fine. I have added two Netflow v9 exporters in two Mikrotik routers and configured the netflow codec according to the documentation:

input {  
udp {  
host =\> "192.168.1.202"  
port =\> 2070  
codec =\> netflow {  
versions =\> [5, 9]  
netflow\_definitions =\> "/usr/local/etc/logstash/netflow.yaml"  
}  
type =\> "netflow"  
}  
udp {  
host =\> "192.168.2.2"  
port =\> 2071  
codec =\> netflow {  
versions =\> [5, 9]  
netflow\_definitions =\> "/usr/local/etc/logstash/netflow.yaml"  
}  
type =\> "netflow"  
}  
}

It works, I can see the Netflow records on Kibana after Logstash acquires the templates, but I have a problem. The IP address fields have the "string" type instead of "ip", which severely limits its usefulness.

Any ideas? I guess this is a stupid question but I am unable to find out where to fix this.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2017, 4:17pm UTC](https://discuss.elastic.co/t/5-2-2-and-netflow-codec-ip-addresses-appear-as-strings/78904/2 "2017-04-13T16:17:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.