Can't convert the string datatype to ip

mutate {
convert => { "ip_addr" => "ip" }

I tried using this. It gives me an error before it even starts indexing anything. I read something in a post from about 2 years ago and it said convert can't change specialised datatypes. Is there another way to change the datatype of a string to ip?

Mapping to IP doesn't happen inside Logstash, but rather in ElasticSearch.

You'd need to have a mapping or template applied to ElasticSearch where you define that specific field as IP, which then converts string values to IP datatypes internally.

Thank you. That worked.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.