# Beats Default Template Mappings for IP Fields

**URL:** <https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644>\
**Category:** Beats\
**Created:** [August 1, 2018, 7:23pm UTC](https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644 "2018-08-01T19:23:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [August 1, 2018, 7:23pm UTC](https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644/1 "2018-08-01T19:23:51Z")

</div>

I've noticed that a lot of the beats default templates have IP fields as the `keyword` datatype. Since elasticsearch supports an `ip` datatype, which makes subnet mask filtering/searching really handy, I would think you would want to map these fields as type `ip`.

Is there a reason for loading it as a `keyword` type? I'm thinking about manually editing the template, but if there is a resiliency reason for not mapping as `ip` I would like to know.

Here are some examples:  
[filebeat iis](https://github.com/elastic/beats/blob/5a6630a8bc9b9caf312978f57d1d9193bdab1ac7/filebeat/module/iis/access/_meta/fields.yml) `access.server_ip` `access.remote_ip`

[filebeat apache2](https://github.com/elastic/beats/blob/5a6630a8bc9b9caf312978f57d1d9193bdab1ac7/filebeat/module/apache2/access/_meta/fields.yml) `access.server_ip` `access.remote_ip`

[packetbeat](https://github.com/elastic/beats/blob/5a6630a8bc9b9caf312978f57d1d9193bdab1ac7/packetbeat/_meta/fields.yml) `ip` `client_ip` `real_ip`

An exception:  
[heartbeat's](https://github.com/elastic/beats/blob/5a6630a8bc9b9caf312978f57d1d9193bdab1ac7/heartbeat/_meta/fields.common.yml#L46) `monitor.ip`

thanks

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [August 2, 2018, 8:31am UTC](https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644/2 "2018-08-02T08:31:02Z")

</div>

Hi @Micah_Hunsberger,

This is a good point, I think the main reason is the type was not around when these modules were created. Could you please open an issue in Github to make use of it? As this is a breaking change we would need to introduce it in 7.0.

> **[elastic/beats](https://github.com/elastic/beats/issues)**
>
> beats - :tropical\_fish: Beats - Lightweight shippers for Elasticsearch & Logstash

Best regards

---

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [August 2, 2018, 3:47pm UTC](https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644/3 "2018-08-02T15:47:00Z")

</div>

Thanks,  
for anyone following this conversation, here's the link to the issue: [https://github.com/elastic/beats/issues/7847](https://github.com/elastic/beats/issues/7847)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2018, 5:47pm UTC](https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644/4 "2018-08-30T17:47:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.