# Cant get proper "type" : "ip" **URL:** \ **Category:** Elasticsearch\ **Created:** [March 15, 2016, 8:50pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490 "2016-03-15T20:50:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Blake\_Wolfson](https://avatars.discourse-cdn.com/v4/letter/b/c68b51/32.png) [@Blake\_Wolfson](https://discuss.elastic.co/u/Blake_Wolfson)\ **Post date:** [March 15, 2016, 8:50pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/1 "2016-03-15T20:50:53Z")
I've seen this around the internet, so I don't think I'm the only one having this issue. I send data from logstash -\> elk This is my config for logstash: if [type] == "paloalto" and [SourceIP] !~ "(^127.0.0.1)|(^10.)|(^172.1[6-9].)|(^172.3[0-1].)|(^192.168..)|(^169.254.)" { ``` geoip { source => "SourceIP" target => "geoipsrc" database => "/etc/logstash/GeoLiteCity.dat" add_field => ["[geoipsrc][coordinates]", "%{[geoipsrc][longitude]}" ] add_field => ["[geoipsrc][coordinates]", "%{[geoipsrc][latitude]}" ] } mutate { convert => ["[geoipsrc][coordinates]", "float"] } } ``` Elasticsearch gives me this error: "\_type"=\>"paloalto", "\_id"=\>"AVN7-ovpvfjK8wUv\_2e9", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [geoipsrc.ip]", "caused\_by"=\>{"type"=\>"number\_format\_exception", "reason"=\>"For input string: "93.189.26.18""}}}}, :level=\>:warn} This is my template; it only errors out on "type": "ip" . Is this a bug? "geoipsrc" : { "properties" : { "area\_code" : { "type" : "long" }, "city\_name" : { "type" : "string", "index" : "not\_analyzed" }, "continent\_code" : { "type" : "string", "index" : "not\_analyzed" }, "coordinates" : { "type" : "double" }, "country\_code2" : { "type" : "string", "index" : "not\_analyzed" }, "country\_code3" : { "type" : "string", "index" : "not\_analyzed" }, "country\_name" : { "type" : "string", "index" : "not\_analyzed" }, "dma\_code" : { "type" : "long" }, **"ip" : {** \*\* "type" : "ip"\*\* \*\* },\*\* ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 16, 2016, 3:50am UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/2 "2016-03-16T03:50:12Z")
If you take a message and then run it through with stdout + rubydebug, what does that field look like? ---
**Author:** ![Blake\_Wolfson](https://avatars.discourse-cdn.com/v4/letter/b/c68b51/32.png) [@Blake\_Wolfson](https://discuss.elastic.co/u/Blake_Wolfson)\ **Post date:** [March 16, 2016, 6:06pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/3 "2016-03-16T18:06:25Z")
{ "message" =\> "Mar 9 22:18:48 1,2016/03/09 14:18:48,001801014079,TRAFFIC,end,1,2016/03/09 14:18:47,10.130.176.36,23.212.187.190,167.167.16.3,23.212.187.190,Permit\_Trust\_Out,,,ssl,vsys1,trust,untrust,ethernet1/3,ethernet1/2,Traffic Logs to GISO,2016/03/09 14:18:48,186042,1,40489,443,60197,443,0x404000,tcp,allow,2866,1985,881,15,2016/03/09 14:16:17,121,any,0,1865515826,0x0,10.0.0.0-10.255.255.255,United States,0,9,6", "@version" =\> "1", "@timestamp" =\> "2016-03-16T18:03:24.955Z", "path" =\> "/etc/logstash/paloalto/paa.log", "host" =\> "ukequlvpoc003", "type" =\> "paloalto", "Domain" =\> "Mar 9 22:18:48 1", "ReceiveTime" =\> "2016/03/09 14:18:48", "Serial" =\> "001801014079", "Type" =\> "TRAFFIC", "ThreatContentType" =\> "end", "ConfigVersion" =\> "1", "GenerateTime" =\> "2016/03/09 14:18:47", "SourceIP" =\> "10.130.176.36", "DestinationIP" =\> "23.212.187.190", "NATSourceIP" =\> "167.167.16.3", "NATDestinationIP" =\> "23.212.187.190", "Rule" =\> "Permit\_Trust\_Out", "SourceUser" =\> nil, "DestinationUser" =\> nil, "Application" =\> "ssl", "VirtualSystem" =\> "vsys1", "SourceZone" =\> "trust", "DestinationZone" =\> "untrust", "InboundInterface" =\> "ethernet1/3", "OutboundInterface" =\> "ethernet1/2", "LogAction" =\> "Traffic Logs to GISO", "TimeLogged" =\> "2016/03/09 14:18:48", "SessionID" =\> "186042", "RepeatCount" =\> "1", "SourcePort" =\> "40489", "DestinationPort" =\> "443", "NATSourcePort" =\> "60197", "NATDestinationPort" =\> "443", "Flags" =\> "0x404000", "Protocol" =\> "tcp", "Action" =\> "allow", "Bytes" =\> "2866", "BytesSent" =\> "1985", "BytesReceived" =\> "881", "Packets" =\> "15", "StartTime" =\> "2016/03/09 14:16:17", "ElapsedTime" =\> "121", "Category" =\> "any", "Padding" =\> "0", "Seqnum" =\> "1865515826", "Actionflags" =\> "0x0", "SourceCountry" =\> "10.0.0.0-10.255.255.255", "DestinationCountry" =\> "United States", "Cpadding" =\> "0", "PktsSent" =\> "9", "PktsReceived" =\> "6", "tags" =\> [ [0] "pa-traffic" ], "geoipdst" =\> { "ip" =\> "23.212.187.190", "country\_code2" =\> "US", "country\_code3" =\> "USA", "country\_name" =\> "United States", "continent\_code" =\> "NA", "region\_name" =\> "MA", "city\_name" =\> "Cambridge", "postal\_code" =\> "02142", "latitude" =\> 42.362599999999986, "longitude" =\> -71.0843, "dma\_code" =\> 506, "area\_code" =\> 617, "timezone" =\> "America/New\_York", "real\_region\_name" =\> "Massachusetts", "location" =\> [ [0] -71.0843, [1] 42.362599999999986 ], "coordinates" =\> [ [0] -71.0843, [1] 42.362599999999986 ] } } ---
**Author:** ![Blake\_Wolfson](https://avatars.discourse-cdn.com/v4/letter/b/c68b51/32.png) [@Blake\_Wolfson](https://discuss.elastic.co/u/Blake_Wolfson)\ **Post date:** [March 16, 2016, 6:36pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/4 "2016-03-16T18:36:51Z")
Here's another one broken down really simple; { "paloalto-2016.03.16": { "aliases": { }, "mappings": { "paloalto": { }, "tweet": { "properties": { "Domain": { "type": "ip" }, "message": { "type": "string" } } } }, "settings": { "index": { "creation\_date": "1458153301420", "uuid": "oJaZ0OHTS86lhIsgm3BlNg", "number\_of\_replicas": "1", "number\_of\_shards": "1", "version": { "created": "2020199" } } }, "warmers": { } } } ---
**Author:** ![Blake\_Wolfson](https://avatars.discourse-cdn.com/v4/letter/b/c68b51/32.png) [@Blake\_Wolfson](https://discuss.elastic.co/u/Blake_Wolfson)\ **Post date:** [March 16, 2016, 6:39pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/5 "2016-03-16T18:39:58Z")
{ "message" =\> "192.168.1.6", "@version" =\> "1", "@timestamp" =\> "2016-03-16T18:39:20.148Z", "path" =\> "/etc/logstash/paloalto/patest.log", "host" =\> "ukequlvpoc003", "type" =\> "paloalto", "Domain" =\> "192.168.1.6", "tags" =\> [ [0] "pa-threats" ] } ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [March 16, 2016, 6:40pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/6 "2016-03-16T18:40:13Z")
The answer is in this thread [GeoIP location has added brackets and not able to visualize](https://discuss.elastic.co/t/geoip-location-has-added-brackets-and-not-able-to-visualize/44259/7). Basically, you are using the wrong config for geoip. There is no need to use mutate plugin with geoip plugin. When you use geoip plugin, it will output a bunch of fields, and `location`, one of the fields, has geo\_point format and contains the info needed for Kibana to graph Tile maps. You just need a mapping template for the geoip fields in ES. Below is what the mapping looks like: ```auto "geoip": { "dynamic": true, "type": "object", "properties": { "city_name": { "index": "not_analyzed", "type": "string" }, "timezone": { "index": "not_analyzed", "type": "string" }, "country_code2": { "index": "not_analyzed", "type": "string" }, "country_name": { "index": "not_analyzed", "type": "string" }, "continent_code": { "index": "not_analyzed", "type": "string" }, "location": { "type": "geo_point", "doc_values": true }, "region_name": { "index": "not_analyzed", "type": "string" }, "real_region_name": { "index": "not_analyzed", "type": "string" }, "postal_code": { "index": "not_analyzed", "type": "string" } } }, ``` geoip.location is the field for Tile map in Kibana. ---
**Author:** ![Blake\_Wolfson](https://avatars.discourse-cdn.com/v4/letter/b/c68b51/32.png) [@Blake\_Wolfson](https://discuss.elastic.co/u/Blake_Wolfson)\ **Post date:** [March 16, 2016, 6:42pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/7 "2016-03-16T18:42:04Z")
Nope. If input a file with one ip address "192.168.1.1" and then I create a template with "domain":"ip" it says that this is not the right type Failed action. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"paloalto-2016.03.16", :\_type=\>"paloalto", :\_routing=\>nil}, #\"/etc/logstash/paloalto/patest.log"}, @accessors=#\"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, @lut={"path"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "path"], "host"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "host"], "type"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "type"], "[type]"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "type"], "[message]"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "message"], "message"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "message"], "[Domain]"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "Domain"], "tags"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "tags"], "[SourceIP]"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "SourceIP"], "SourceIP"=\>[{"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, "SourceIP"]}\>, @data={"message"=\>"192.168.1.5", "@version"=\>"1", "@timestamp"=\>"2016-03-16T18:35:00.610Z", "path"=\>"/etc/logstash/paloalto/patest.log", "host"=\>"ukequlvpoc003", "type"=\>"paloalto", "Domain"=\>"192.168.1.5", "tags"=\>["pa-threats"]}, @metadata\_accessors=#\"/etc/logstash/paloalto/patest.log"}, @lut={"[path]"=\>[{"path"=\>"/etc/logstash/paloalto/patest.log"}, "path"]}\>, @cancelled=false\>], :response=\>{"create"=\>{"\_index"=\>"paloalto-2016.03.16", "\_type"=\>"paloalto", "\_id"=\>"AVOAtaZj6FFiT7UMT\_ZE", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [Domain]", "caused\_by"=\>{"type"=\>"number\_format\_exception", "reason"=\>"For input string: "192.168.1.5""}}}}, :level=\>:warn} this isnt normal behavior... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:07pm UTC](https://discuss.elastic.co/t/cant-get-proper-type-ip/44490/8 "2017-07-05T23:07:47Z")