Beats Default Template Mappings for IP Fields

Elastic Stack Beats
1

I've noticed that a lot of the beats default templates have IP fields as the keyword datatype. Since elasticsearch supports an ip datatype, which makes subnet mask filtering/searching really handy, I would think you would want to map these fields as type ip.

Is there a reason for loading it as a keyword type? I'm thinking about manually editing the template, but if there is a resiliency reason for not mapping as ip I would like to know.

Here are some examples:
filebeat iis access.server_ip access.remote_ip

filebeat apache2 access.server_ip access.remote_ip

packetbeat ip client_ip real_ip

An exception:
heartbeat's monitor.ip

thanks

2

Hi @Micah_Hunsberger,

This is a good point, I think the main reason is the type was not around when these modules were created. Could you please open an issue in Github to make use of it? As this is a breaking change we would need to introduce it in 7.0.

Best regards

1 Like
3

Thanks,
for anyone following this conversation, here's the link to the issue: https://github.com/elastic/beats/issues/7847

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.