# Graph and IP type data

**URL:** <https://discuss.elastic.co/t/graph-and-ip-type-data/47309>\
**Category:** Kibana\
**Tags:** elastic-stack-graph\
**Created:** [April 13, 2016, 9:06pm UTC](https://discuss.elastic.co/t/graph-and-ip-type-data/47309 "2016-04-13T21:06:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lawndart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lawndart/32/8668_2.png) [@lawndart](https://discuss.elastic.co/u/lawndart)\
**Post date:** [April 13, 2016, 9:06pm UTC](https://discuss.elastic.co/t/graph-and-ip-type-data/47309/1 "2016-04-13T21:06:53Z")

</div>

I am trying to play around with Graph and some net flow data and keep getting a Server Error 500, with the following in the elasticsearch logs:

Caused by: java.lang.IllegalArgumentException: failed to parse ip [], not a valid ip address

I do have the type set correctly and it shows as an "ip" type in the regular Kibana interface, and I can query it just fine everywhere else. Did I miss a step in Graph where I define the data types again?

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [April 13, 2016, 9:49pm UTC](https://discuss.elastic.co/t/graph-and-ip-type-data/47309/2 "2016-04-13T21:49:44Z")

</div>

Hi Bryce,  
This is down to an issue I discovered today in core elasticsearch with ip field types and aggregations [1]

For now, the work-around is to use a non-analyzed string field for this sort of analysis.

However, longer term there are other reasons why graph/significant\_terms will need to work with string-based representations of things like IP fields in future. It is related to changes in Lucene's handling of numeric fields and the fact that it will no longer hold document frequencies (these frequencies are required for computing significance).

Cheers  
Mark

[1] [https://github.com/elastic/elasticsearch/issues/17705](https://github.com/elastic/elasticsearch/issues/17705)

---

<div class="post-metadata">

**Author:** ![lawndart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lawndart/32/8668_2.png) [@lawndart](https://discuss.elastic.co/u/lawndart)\
**Post date:** [April 15, 2016, 5:47pm UTC](https://discuss.elastic.co/t/graph-and-ip-type-data/47309/3 "2016-04-15T17:47:31Z")

</div>

Thanks, we are still in a dev mode, so flopping our IPs over is a thing we can do quite easily.

Bryce

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:43pm UTC](https://discuss.elastic.co/t/graph-and-ip-type-data/47309/4 "2017-07-06T13:43:55Z")

</div>

Closed on July 6, 2017, 1:43pm UTC