# Changing mapping type to IP

**URL:** <https://discuss.elastic.co/t/changing-mapping-type-to-ip/191262>\
**Category:** Elasticsearch\
**Created:** [July 18, 2019, 5:54pm UTC](https://discuss.elastic.co/t/changing-mapping-type-to-ip/191262 "2019-07-18T17:54:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![userelastic](https://avatars.discourse-cdn.com/v4/letter/u/c4cdca/32.png) [@userelastic](https://discuss.elastic.co/u/userelastic)\
**Post date:** [July 18, 2019, 5:54pm UTC](https://discuss.elastic.co/t/changing-mapping-type-to-ip/191262/1 "2019-07-18T17:54:27Z")

</div>

Hi everyone; I have a Cisco ASA Firewall sending logs to ES through Logstash; I noticed that couple of fields are defined as text. Can you please guide me how can I can them into IP type? Following is the mapping and I need to change the type of "dst\_ip" field.

GET logstash-ciscoasa\*/\_mapping  
{  
"logstash-ciscoasa-2019.06" : {  
"mappings" : {  
"dynamic\_templates" : [  
{  
"message\_field" : {  
"path\_match" : "message",  
"match\_mapping\_type" : "string",  
"mapping" : {  
"norms" : false,  
"type" : "text"  
}  
}  
},  
{  
"string\_fields" : {  
"match" : "\*",  
"match\_mapping\_type" : "string",  
"mapping" : {  
"fields" : {  
"keyword" : {  
"ignore\_above" : 256,  
"type" : "keyword"  
}  
},  
"norms" : false,  
"type" : "text"  
}  
}  
}  
],  
"properties" : {  
"@timestamp" : {  
"type" : "date"  
},  
"@version" : {  
"type" : "keyword"  
},  
"action" : {  
"type" : "text",  
"norms" : false,  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"cisco\_message" : {  
"type" : "text",  
"norms" : false,  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"dst\_ip" : {  
"type" : "text",  
"norms" : false,  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [July 18, 2019, 6:42pm UTC](https://discuss.elastic.co/t/changing-mapping-type-to-ip/191262/2 "2019-07-18T18:42:39Z")

</div>

Here is a keyword field where I added IP mapping in the template:

```
 "mappings": {
  "doc": {
    "properties" : {
      "ip_address" : {
        "type" : "keyword",
        "fields" : {
          "ip" : {
            "type" : "ip"
          }
        }
      }

```

So ip\_address is a keyword and ip\_address.ip is mapped as ip.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2019, 6:45pm UTC](https://discuss.elastic.co/t/changing-mapping-type-to-ip/191262/3 "2019-08-15T18:45:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.