# Elasticsearch mappings for ASA

**URL:** <https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515>\
**Category:** Elasticsearch\
**Created:** [February 22, 2020, 10:39pm UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515 "2020-02-22T22:39:35Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![digger86](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@digger86](https://discuss.elastic.co/u/digger86)\
**Post date:** [February 22, 2020, 10:39pm UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/1 "2020-02-22T22:39:35Z")

</div>

I am new to using the Elastic stack. What is most important to me is to collect firewall logs from an ASA. One of the challenges is that I cannot not search for networks in the logs because the IP addresses are mapped to a text field.

```
{
  "logstash-2019.12.05" : {
    "mappings" : {
      "dst_ip" : {
        "full_name" : "dst_ip",
        "mapping" : {
          "dst_ip" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          }
        }
      }
    }
  }
}

```

What I think I want it to be

```
 },
      "dst_ip": {
        "type": "ip"
      },

```

I get an error when I try to install the template. I have to add the template in a separate post because I am exceeding the amount of characters allowed.

```
PUT _template/asa_firewall_template
{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "request body is required"
      }
    ],
    "type": "parse_exception",
    "reason": "request body is required"
  },
  "status": 400
}

```

What am I doing wrong and how do I fix this?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![digger86](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@digger86](https://discuss.elastic.co/u/digger86)\
**Post date:** [February 22, 2020, 10:42pm UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/2 "2020-02-22T22:42:26Z")

</div>

Template can be found at:

> <https://gist.github.com/digger-squared/9065135956c6a29216dafe9c20730a0f>

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 22, 2020, 10:52pm UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/4 "2020-02-22T22:52:02Z")

</div>

Welcome!

Make sure you are running:

```
PUT _template/asa_firewall_template
{
  //...
}

```

And not:

```
PUT _template/asa_firewall_template

{
  //...
}
```

---

<div class="post-metadata">

**Author:** ![digger86](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@digger86](https://discuss.elastic.co/u/digger86)\
**Post date:** [February 22, 2020, 11:04pm UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/5 "2020-02-22T23:04:22Z")

</div>

Thanks for your help. I get an error.

[https://pastebin.com/DiN4JntH](https://pastebin.com/DiN4JntH)

---

<div class="post-metadata">

**Author:** ![digger86](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@digger86](https://discuss.elastic.co/u/digger86)\
**Post date:** [February 23, 2020, 12:23am UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/6 "2020-02-23T00:23:42Z")

</div>

I tried from the CLI too, but get the same error as above

`
# curl -XPUT http://localhost:9200/_template/asa_firewall_template?pretty -H 'Content-Type: application/json' -d @asa_firewall_template.json
`

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 23, 2020, 2:41am UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/7 "2020-02-23T02:41:36Z")

</div>

I'd start by removing ` "_default_"` Key.  
Have a look at the documentation about the template API. There are some examples.

---

<div class="post-metadata">

**Author:** ![digger86](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@digger86](https://discuss.elastic.co/u/digger86)\
**Post date:** [February 23, 2020, 5:25am UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/9 "2020-02-23T05:25:45Z")

</div>

Thanks again for your help.

I have tried that, but still get the same error

```
PUT _template/asa_firewall_template
{
  "template" : "asa-firewall*",
  "version" : 50001,
  "settings" : {
    "index.refresh_interval" : "5s"
  },
    "mappings" : {
      "asa_template" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
          }
        },
//....

```

I have also tried loading the index and a few mappings separately and it works this far.

`PUT /asa-firewall`

and then

```
PUT /asa-firewall/_mapping
{ 
      "properties" : {
        "@timestamp" : {
          "type" : "date"
          }
        }
      }

```

And

```
PUT /asa-firewall/_mapping
{
"properties": { 
 "err_icmp_code" : {
  "type" : "text",
    "fields" : {
      "keyword" : {
        "type" : "keyword",
          "ignore_above" : 256
      }
    }
  }
 }
}

```

This is working thus far

```
GET asa-firewall/_mapping
{
  "asa-firewall" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "err_icmp_code" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 23, 2020, 6:12am UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/10 "2020-02-23T06:12:01Z")

</div>

I think you need to remove `"asa_template"`. There's no more type name to set in 7.x version.

---

<div class="post-metadata">

**Author:** ![digger86](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@digger86](https://discuss.elastic.co/u/digger86)\
**Post date:** [February 23, 2020, 6:48am UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/11 "2020-02-23T06:48:18Z")

</div>

Tried it same error.

I also tried just placing the mappings to the index.

Mappings:  
[https://pastebin.com/vm0K2pTt](https://pastebin.com/vm0K2pTt)

But I get the following error.  
[https://pastebin.com/fU3GyhyY](https://pastebin.com/fU3GyhyY)

---

<div class="post-metadata">

**Author:** ![digger86](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@digger86](https://discuss.elastic.co/u/digger86)\
**Post date:** [February 23, 2020, 9:03pm UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/12 "2020-02-23T21:03:18Z")

</div>

I got it working!

All I can say is that format is a killer and one must use a json validator with a good editor that can match brackets, I used VIM. And even if it is valid, it still may not be valid for Elastic. This was the case for me.

When I remove "_default_" I removed the wrong closing bracket.

Here is revised template.

> <https://gist.github.com/digger-squared/9065135956c6a29216dafe9c20730a0f>

Thanks dadoonet for the help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2020, 9:03pm UTC](https://discuss.elastic.co/t/elasticsearch-mappings-for-asa/220515/13 "2020-03-22T21:03:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.