Change mapping question

Elastic Stack Elasticsearch
1

Dear All,

I would like change one of the field type from "text" to "IP" for geoip use but fail. May i know how to do that. Thanks

GET /syslog/_mapping
{
"syslog": {
"mappings": {
"doc": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Description": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Destination IP": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Destination Port": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Signature ID": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Signature IS": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Signature Name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Signature Severity": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Source IP": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}
}

Tried to change source IP type from text to IP by following
PUT /syslog
{
"properties": {
"Destination IP": {
"type": "IP",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}

Result

{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "unknown setting [index.properties.Destination IP.fields.keyword.ignore_above] please check that any required plugins are installed, or check the breaking changes documentation for removed settings"
}
],
"type": "illegal_argument_exception",
"reason": "unknown setting [index.properties.Destination IP.fields.keyword.ignore_above] please check that any required plugins are installed, or check the breaking changes documentation for removed settings"
},
"status": 400
}

2

This section is particularly relevant from here, even though the post is old.

It's far easier to simply add a new field with the correct mapping and then send the data to it.

3

Thanks for your reply. I success to change type after delete the mapping and PUT again. However, the old data cannot search