Can't get IP as index pattern


This is using straight ntopng to elasticsearch:
No Compatible Fields: The "ntopng-*" index pattern does not contain any of the following field types: ip

yet the field IPV4_SRC_ADDR is clearly an IP address. Why are my options only URL, String, and Truncated String? Thank you.

(Mark Walkom) #2

Showing your mappings would be useful :slight_smile:


You mean this?

Or....somewhere different :smiley:

(Mark Walkom) #4

Well that shows it as a string, not an IP.
What does ntopng-*/_mapping show?

#5's what I got:


(Mark Walkom) #6

Ok so it's not mapped, which you will need to fix and then reindex older data for.

#7 how do I fix it :smiley:

(Mark Walkom) #8

Update your ntopng-* template to map the field to the IP field type, assuming you have one.


Ok thanks Mark...looks like I have more reading to do as it doesn't appear you can update a map field within Kibana :frowning:

(system) #10