Can't properly map array of IPv4 from Logstash to ES

Elastic Stack Elasticsearch
1

I'm having trouble getting Elasticsearch to accept my array of IPv4 as IPv4 instead of strings.
I have a string with many IPs separated by spaces. I can easily turn that field into an array of IPs by using the split function in either the ruby or mutate filters.

The problem is that even though I already have the field "ip_addresses" mapped to be of type "ip", Elasticsearch does not parse the field and gives error message:
"Mixing up field types: class org.elasticsearch.index.mapper.core.LongFieldMapper$LongFieldType != class org.elasticsearch.index.mapper.ip.IpFieldMapper$IpFieldType on field ip_addresses"

If I try to map it as type long, it fails with the same error because of String/Long mismatch. If I don't map them at all, dynamic mapping sets the type of the field to String.

Here's the rubydebug picture of the field I'm trying to push up to ES:

Here's the exact error message:

1278×32 14.4 KB

Here's my previously defined mapping for that field:

The only somewhat relevant source of information I found is here: http://stackoverflow.com/questions/29770043/how-can-i-store-and-search-multiple-ipv4-and-ipv6-subnets-in-elasticsearch

And according to documentation on arrays:

In Elasticsearch, there is no dedicated array type. Any field can contain zero or more values by default, however, all values in the array must be of the same datatype.

GIven that any field can be made into an array, how can I properly have an array of type ip?

2

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them :slight_smile:

That aside, as you saw in the docs you cannot map an array, it just works. So I am not sure this would work beyond a string or an integer. Let me move this to the Elasticsearch category as it seems more suited to that =.

3

Oh ok, sorry about the pictures. I mentioned what's on the pictures already so that was more for reference in case I wasn't very clear. Thanks for moving it to the appropriate category!

4

Hello,

I have the same kind of problem and I would like to know if you find a solution since the last reply?

Thank you

5

There is an issue on the matter: https://github.com/elastic/elasticsearch/issues/18740

6

Thank you for the reply.

Well, my problem was resolved by another way. In fact, I have this error (Mixed up fields type) because the elasticsearch type was wrong (it's was something like array_%{array_name}), the "%{array_name}" was not interpreted by Elasticsearch (for a good reason).
Resolving this issue remove the error... Strange but it works now.

Thank you

1 Like