# Convert in pipeline is not converting

**URL:** <https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964>\
**Category:** Elasticsearch\
**Created:** [May 22, 2024, 7:40am UTC](https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964 "2024-05-22T07:40:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Balu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balu/32/37569_2.png) [@Balu](https://discuss.elastic.co/u/Balu)\
**Post date:** [May 22, 2024, 7:40am UTC](https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964/1 "2024-05-22T07:40:37Z")

</div>

Hello folks,

I created an Ingest Pipeline that uses some grok patterns to split up fields. In the end I do a few converts to change the type of the fields.

For example I am converting this field into an `IP`:

```auto
  {
    "convert": {
      "field": "dovecot.lip",
      "type": "ip",
      "ignore_missing": true
    }
  },

```

But in my documents those fields are still saved as type `Keyword`.

What am I missing?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 22, 2024, 7:52am UTC](https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964/2 "2024-05-22T07:52:00Z")

</div>

You also need to adjust the mapping.  
The ingest pipeline only modifies the json document.

---

<div class="post-metadata">

**Author:** ![Balu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balu/32/37569_2.png) [@Balu](https://discuss.elastic.co/u/Balu)\
**Post date:** [May 22, 2024, 8:51am UTC](https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964/3 "2024-05-22T08:51:58Z")

</div>

Ah ok. I had thought that if there are no mappings defined yet, it'll use the type of the json fields when saving the document.

So I guess I need to invest more time into proper templates.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 22, 2024, 9:25am UTC](https://discuss.elastic.co/t/convert-in-pipeline-is-not-converting/359964/4 "2024-05-22T09:25:37Z")

</div>

It uses the default mapping. For text data, it will be a mix of `text` field and `keyword` subfield by default, unless you changed it.  
It does not detect "IP addresses" from strings by default.

That's why you somewhat need to "force it".