# Different field types from same grok statement

**URL:** <https://discuss.elastic.co/t/different-field-types-from-same-grok-statement/209966>\
**Category:** Logstash\
**Created:** [November 29, 2019, 12:01pm UTC](https://discuss.elastic.co/t/different-field-types-from-same-grok-statement/209966 "2019-11-29T12:01:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [November 29, 2019, 12:01pm UTC](https://discuss.elastic.co/t/different-field-types-from-same-grok-statement/209966/1 "2019-11-29T12:01:47Z")

</div>

Hi,

I use the below grok to convert the source.address to source.ip and convert from string to IP as part of the ECS.

I have firewall and IPS logs running through this. Prior to the grok i convert source.address to string so that all sources are the same. source.ip does not exist before this. The firewall and ips logs are indexed using the same index pattern.

The issue is that the firewall is correctly indexing as IP but the IPS logs are coming in as text and creating a conflict  
.  
Any idea as to why this might be happening? source.address is indexed as string.

```
if "source.address" {
  grok {
    match => ["source.address", "(?:%{IP:source.ip}|%{GREEDYDATA:source.domain})"]
    add_tag => ["srcip"]
  }
}

```

Thanks  
Phil

---

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [December 2, 2019, 3:11pm UTC](https://discuss.elastic.co/t/different-field-types-from-same-grok-statement/209966/2 "2019-12-02T15:11:05Z")

</div>

After days of going in a loop i decided to look at the indices mapping. Issue is due to me pushing filebeat through logstash and using a logstash output to put the beats version into the index. I didnt have a template for 7.2.0 but had one for 7.4.2. I had originally pointed filebeat at ES to get the dashboards.

Sorted now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2019, 3:11pm UTC](https://discuss.elastic.co/t/different-field-types-from-same-grok-statement/209966/3 "2019-12-30T15:11:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.