Can't get IP as index pattern

Elastic Stack Kibana
1

This is using straight ntopng to elasticsearch:
No Compatible Fields: The "ntopng-*" index pattern does not contain any of the following field types: ip

yet the field IPV4_SRC_ADDR is clearly an IP address. Why are my options only URL, String, and Truncated String? Thank you.

2

Showing your mappings would be useful :slight_smile:

3

You mean this?

Or....somewhere different :smiley:

4

Well that shows it as a string, not an IP.
What does ntopng-*/_mapping show?

5

Ok...here's what I got:

           "IPV4_SRC_ADDR":{  
              "type":"string",
              "norms":{  
                 "enabled":false
              },
              "fields":{  
                 "raw":{  
                    "type":"string",
                    "index":"not_analyzed",
                    "ignore_above":256
                 }
              }
           },
6

Ok so it's not mapped, which you will need to fix and then reindex older data for.

7

Awesome.......so how do I fix it :smiley:

8

Update your ntopng-* template to map the field to the IP field type, assuming you have one.

9

Ok thanks Mark...looks like I have more reading to do as it doesn't appear you can update a map field within Kibana :frowning: