# How to change Data-Type in a Field to only get an Ip-Adr?
**URL:** https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994
**Category:** Logstash
**Created:** [July 24, 2019, 9:31am UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994 "2019-07-24T09:31:03Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [July 24, 2019, 9:31am UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/1 "2019-07-24T09:31:03Z")
Hey Community,
so basically i'm totally new to ES. I set up an Elk-Cluster with 2 Worker Node's, and a Master Node running Kibana etc.
I attached a security system to it via logstash, so now i get the syslogs and it all works out just fine.
I wanted to use the GeoIP Module because bosses love that stuff.
My Problem is, that the Firewall only attaches the IP address in a field call 'ui' but painfully its written like "ssh (x.x.x.x)" like 60% of the time. Instead of reconfiguring the Firewall, is there a way for me to convert this field into a type which fits my needs?
Sorry for asking something this low -level, but as i said, totally new in this field.
I know that it has something to do with the Mapping Configuration.
```
*"ui": {*
```
-
```
"type": "text",*
```
-
```
"norms": false,*
```
-
```
"fields": {*
```
-
```
"keyword": {*
```
-
```
"type": "keyword",*
```
-
```
"ignore_above": 256*
```
But yet i'm too new to this topic to know where to find this setting.
Greetz
Moritz
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 24, 2019, 12:36pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/2 "2019-07-24T12:36:57Z")
> [@Moritz\_Kiesewetter](#):
>
> like 60% of the time
What does that field look like the other 40% of the time?
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [July 24, 2019, 1:18pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/3 "2019-07-24T13:18:47Z")
@Badger
Plain RemoteIP's 'x.x.x.x' , just the format i'd need.
It depends on which Access Control is being tested.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 24, 2019, 1:24pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/4 "2019-07-24T13:24:02Z")
OK, so you can use grok to extract the ip address
```
grok { match => { "someField" => "%{IPV4:ip}" } }
```
That will work for both "ssh (10.2.3.4)" and "10.1.2.3".
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [July 24, 2019, 1:39pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/5 "2019-07-24T13:39:39Z")
So simply put it in my /etc/logstash/conf.d/XX-syslog-input.conf file?
But will this not trigger a reindex of all the data stored in there?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 24, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/6 "2019-07-24T14:15:58Z")
Yes, add that to your configuration and new events will have an [ip] field added to them. It does not do anything to documents that have already been indexed.
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [July 25, 2019, 7:36am UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/7 "2019-07-25T07:36:39Z")
Great, i'll check it out today evening !
Thanks in advance 🙂
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [July 25, 2019, 8:32am UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/8 "2019-07-25T08:32:53Z")
Ok i just noticed, will this be a Problem for my Logs if there are around 30000/90000 per Day which do not even have this "ui" Field? Since i changed up the Config, there are no logs comming in at all. Sorry for asking that much.
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [July 25, 2019, 11:53am UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/9 "2019-07-25T11:53:01Z")
So to give you a better view of how it's done in my file here some grok match =\> line which i'll propably have to extend, but i'm not sure about the syntax.
grok {
match =\> ["message", "\S+ \S+ (?\\S+) (?\S+): (?\S+) (?\S+) [Originator@\d+ (?[^]]+)] (?.\*)" ]
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 25, 2019, 12:40pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/10 "2019-07-25T12:40:16Z")
If the field that it tries to match does not exist then the grok is a no-op. If no logs are being ingested you may have a syntax error in the configuration.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2019, 12:40pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-in-a-field-to-only-get-an-ip-adr/191994/11 "2019-08-22T12:40:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.