Convert in pipeline is not converting

Elastic Stack Elasticsearch
1

Hello folks,

I created an Ingest Pipeline that uses some grok patterns to split up fields. In the end I do a few converts to change the type of the fields.

For example I am converting this field into an IP:

  {
    "convert": {
      "field": "dovecot.lip",
      "type": "ip",
      "ignore_missing": true
    }
  },

But in my documents those fields are still saved as type Keyword.

What am I missing?

2

You also need to adjust the mapping.
The ingest pipeline only modifies the json document.

3

Ah ok. I had thought that if there are no mappings defined yet, it'll use the type of the json fields when saving the document.

So I guess I need to invest more time into proper templates.

4

It uses the default mapping. For text data, it will be a mix of text field and keyword subfield by default, unless you changed it.
It does not detect "IP addresses" from strings by default.

That's why you somewhat need to "force it".