# Filebeat Zeek Convert IP Address from "string" to "ip"
**URL:** https://discuss.elastic.co/t/filebeat-zeek-convert-ip-address-from-string-to-ip/200902
**Category:** Beats
**Tags:** filebeat
**Created:** [September 24, 2019, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-zeek-convert-ip-address-from-string-to-ip/200902 "2019-09-24T15:54:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@0x00](https://discuss.elastic.co/u/0x00)
#### Post date: [September 24, 2019, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-zeek-convert-ip-address-from-string-to-ip/200902/1 "2019-09-24T15:54:47Z")
The rename function in `/usr/share/filebeat/module/zeek/connection/config/connection.yml`
```auto
processors:
- drop_fields:
fields: ["json.orig_bytes","json.resp_bytes","json.tunnel_parents"]
- rename:
fields:
- from: "json"
to: "zeek.connection"
- from: "zeek.connection.duration"
to: "temp.duration"
- from: "zeek.connection.id.orig_h"
to: "source.address"
- from: "zeek.connection.id.orig_p"
to: "source.port"
- from: "zeek.connection.id.resp_h"
to: "destination.address"
- from: "zeek.connection.id.resp_p"
to: "destination.port"
...
```
Is failing to set the field type to `ip` and instead adds it as a `string` which seems to be preventing the ip addresses from being handled as ip addresses.
I am trying to replace this with the `convert` function and placed it between the `- drop_fields:` and `- rename:` processors with the settings below.
```auto
- convert:
fields:
- {from: "zeek.connection.id.orig_h", to: "source.address", type: "ip"}
- {from: "zeek.connection.id.resp_h", to: "destination.address", type: "ip"}
- {from: "zeek.connection.id.orig_p", to: "source.port", type: "integer"}
- {from: "zeek.connection.id.resp_p", to: "destination.port", type: "integer"}
```
When it runs the debug filebeat log shows the following error:
`failed in processor.convert: conversion of field [zeek.connection.id.orig_h] to type [ip] with target field [source.address] failed: field [zeek.connection.id.orig_h] is missing: key not found`
What am I doing wrong to get the convert to work here?
---
### Author:  [@kumarabhi](https://discuss.elastic.co/u/kumarabhi)
#### Post date: [September 24, 2019, 5:47pm UTC](https://discuss.elastic.co/t/filebeat-zeek-convert-ip-address-from-string-to-ip/200902/2 "2019-09-24T17:47:23Z")
@0x00 : The error is quite obvious
`failed in processor.convert: conversion of field [zeek.connection.id.orig_h]`
Please put the actions (rename and convert into different processors)
```
processors:
- drop_fields:
fields: ["json.orig_bytes","json.resp_bytes","json.tunnel_parents"]
- rename:
fields:
- from: "json"
to: "zeek.connection"
- from: "zeek.connection.duration"
to: "temp.duration"
- from: "zeek.connection.id.orig_h"
to: "source.address"
- from: "zeek.connection.id.orig_p"
to: "source.port"
- from: "zeek.connection.id.resp_h"
to: "destination.address"
- from: "zeek.connection.id.resp_p"
to: "destination.port"
processors:
- convert:
fields:
- {from: "zeek.connection.id.orig_h", to: "source.address", type: "ip"}
- {from: "zeek.connection.id.resp_h", to: "destination.address", type: "ip"}
- {from: "zeek.connection.id.orig_p", to: "source.port", type: "integer"}
- {from: "zeek.connection.id.resp_p", to: "destination.port", type: "integer"}
```
---
### Author:  [@0x00](https://discuss.elastic.co/u/0x00)
#### Post date: [September 26, 2019, 3:53am UTC](https://discuss.elastic.co/t/filebeat-zeek-convert-ip-address-from-string-to-ip/200902/3 "2019-09-26T03:53:46Z")
> [@kumarabhi](#):
>
> The error is quite obvious
This may be obvious to an experienced user but this is extremely unclear to a novice like me so thank you for your direction.
The log certainly states the error but gives no indication by the error message of what the resolution is _unless_ you already understand how all this works.
I will try this and greatly appreciate you pointing me in the right direction.
---
### Author:  [@kumarabhi](https://discuss.elastic.co/u/kumarabhi)
#### Post date: [September 26, 2019, 5:44pm UTC](https://discuss.elastic.co/t/filebeat-zeek-convert-ip-address-from-string-to-ip/200902/4 "2019-09-26T17:44:00Z")
Sorry but i had no intentions to hurt your feelings. I too started working on ELK stack 2 months ago and am very much a newbie.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2019, 5:44pm UTC](https://discuss.elastic.co/t/filebeat-zeek-convert-ip-address-from-string-to-ip/200902/5 "2019-10-24T17:44:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.