Beat Event Field "IP datatype"

(Ecc256) #1

How do I add Beat Event Field with IP datatype?
fields.Put("client.ip", net.ParseIP(clientIP)) adds string field...

(Christian Dahlqvist) #2

You need to specify this mapping through an index template in Elasticsearch.

(Ecc256) #3

Beat creates index template (if it’s not there already) based on fields.yml.
Could you tell how IP datatype should be defined there, please?

filebeat fields.yml has following lines:
- name: remote_ip
type: keyword
description: >
Client IP address.

I don’t think “keyword” type defines IP datatype...
Am I wrong about it?

(Andrew Wilkins) #4

You should use "type: ip". Here's an example in heartbeat:

(Ecc256) #5

A bit broader/general question:
Looks like string and long field types are recognized properly.
date type is recognized for @timestamp field only.
Does it mean all NOT (string OR long) field types need to be defined in fields.yml?

BTW: Not sure if this is a bug, but:
When a beat is compiled with\elastic\beats from 05/19/18
@timestamp field is not recognized as date type when new index pattern is created.
It does work properly with\elastic\beats from 05/02/18

Don’t know where to reports this...

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.