# Beat Event Field "IP datatype"
**URL:** https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619
**Category:** Beats
**Tags:** beats-development
**Created:** [May 21, 2018, 6:45am UTC](https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619 "2018-05-21T06:45:40Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ecc256](https://discuss.elastic.co/u/ecc256)
#### Post date: [May 21, 2018, 6:45am UTC](https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619/1 "2018-05-21T06:45:40Z")
How do I add Beat Event Field with [IP datatype](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html)?
`fields.Put("client.ip", net.ParseIP(clientIP))` adds string field...
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 21, 2018, 7:23am UTC](https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619/2 "2018-05-21T07:23:34Z")
You need to specify this mapping through an [index template](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/indices-templates.html) in Elasticsearch.
---
### Author:  [@ecc256](https://discuss.elastic.co/u/ecc256)
#### Post date: [May 21, 2018, 5:39pm UTC](https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619/3 "2018-05-21T17:39:58Z")
Beat creates index template (if it’s not there already) based on fields.yml.
Could you tell how IP datatype should be defined there, please?
filebeat [fields.yml](https://github.com/elastic/beats/blob/master/filebeat/module/apache2/access/_meta/fields.yml#L6) has following lines:
fields:
- name: remote\_ip
type: keyword
description: \>
Client IP address.
I don’t think “keyword” type defines IP datatype...
Am I wrong about it?
---
### Author:  [@axw](https://discuss.elastic.co/u/axw)
#### Post date: [May 22, 2018, 1:16am UTC](https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619/4 "2018-05-22T01:16:10Z")
You should use "type: ip". Here's an example in heartbeat: [https://github.com/elastic/beats/blob/5a6630a8bc9b9caf312978f57d1d9193bdab1ac7/heartbeat/\_meta/fields.common.yml#L46](https://github.com/elastic/beats/blob/5a6630a8bc9b9caf312978f57d1d9193bdab1ac7/heartbeat/_meta/fields.common.yml#L46)
---
### Author:  [@ecc256](https://discuss.elastic.co/u/ecc256)
#### Post date: [May 22, 2018, 1:39am UTC](https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619/5 "2018-05-22T01:39:46Z")
Andrew,
A bit broader/general question:
Looks like string and long field types are recognized properly.
date type is recognized for @timestamp field only.
Does it mean all NOT (string OR long) field types need to be defined in fields.yml?
Thanks!
BTW: Not sure if this is a bug, but:
When a beat is compiled with [github.com](http://github.com)\elastic\beats from 05/19/18
@timestamp field is not recognized as date type when new index pattern is created.
It does work properly with [github.com](http://github.com)\elastic\beats from 05/02/18
Don’t know where to reports this...
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 19, 2018, 1:39am UTC](https://discuss.elastic.co/t/beat-event-field-ip-datatype/132619/6 "2018-06-19T01:39:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.