Can't get IP as index pattern


#1

This is using straight ntopng to elasticsearch:
No Compatible Fields: The "ntopng-*" index pattern does not contain any of the following field types: ip

yet the field IPV4_SRC_ADDR is clearly an IP address. Why are my options only URL, String, and Truncated String? Thank you.


(Mark Walkom) #2

Showing your mappings would be useful :slight_smile:


#3

You mean this?

Or....somewhere different :smiley:


(Mark Walkom) #4

Well that shows it as a string, not an IP.
What does ntopng-*/_mapping show?


#5

Ok...here's what I got:

           "IPV4_SRC_ADDR":{  
              "type":"string",
              "norms":{  
                 "enabled":false
              },
              "fields":{  
                 "raw":{  
                    "type":"string",
                    "index":"not_analyzed",
                    "ignore_above":256
                 }
              }
           },

(Mark Walkom) #6

Ok so it's not mapped, which you will need to fix and then reindex older data for.


#7

Awesome.......so how do I fix it :smiley:


(Mark Walkom) #8

Update your ntopng-* template to map the field to the IP field type, assuming you have one.


#9

Ok thanks Mark...looks like I have more reading to do as it doesn't appear you can update a map field within Kibana :frowning:


(system) #10