Can't convert the string datatype to ip

Elastic Stack Logstash
1

mutate {
convert => { "ip_addr" => "ip" }
}

I tried using this. It gives me an error before it even starts indexing anything. I read something in a post from about 2 years ago and it said convert can't change specialised datatypes. Is there another way to change the datatype of a string to ip?

2

Mapping to IP doesn't happen inside Logstash, but rather in ElasticSearch.

You'd need to have a mapping or template applied to ElasticSearch where you define that specific field as IP, which then converts string values to IP datatypes internally.

3

Thank you. That worked.