# How to change IP fields datatype to ip from keyword in packetbeat 6.x
**URL:** https://discuss.elastic.co/t/how-to-change-ip-fields-datatype-to-ip-from-keyword-in-packetbeat-6-x/169395
**Category:** Beats
**Tags:** packetbeat
**Created:** [February 21, 2019, 10:52am UTC](https://discuss.elastic.co/t/how-to-change-ip-fields-datatype-to-ip-from-keyword-in-packetbeat-6-x/169395 "2019-02-21T10:52:44Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sohaibomr](https://discuss.elastic.co/u/sohaibomr)
#### Post date: [February 21, 2019, 10:52am UTC](https://discuss.elastic.co/t/how-to-change-ip-fields-datatype-to-ip-from-keyword-in-packetbeat-6-x/169395/1 "2019-02-21T10:52:44Z")
Currently in packetbeat 6.x all the ip fields are indexed as datatype keyword in the elasticsearh. How can I change the default type of ip?
As suggested in below [this](https://github.com/elastic/beats/issues/7847#issuecomment-443768816) issue I have tried to change the datatype using ingest pipeline or beats processor but I couldn't make it work.
Thanks
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 21, 2019, 1:59pm UTC](https://discuss.elastic.co/t/how-to-change-ip-fields-datatype-to-ip-from-keyword-in-packetbeat-6-x/169395/2 "2019-02-21T13:59:54Z")
The data types are controlled by the Elasticsearch index template. Packetbeat provides its own when it first connects to Elasticsearch. But you could customize it.
1. `packetbeat help export template`
2. `packetbeat export template --es.version=6.6.0 > packetbeat-6.6.0-template.json`
3. Set the `"type": "ip"` for `ip` and `client_ip`.
4. Install the template to Elasticsearch as per this instructions [here](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-template.html#load-template-manually-alternate).
The template is used to define the mapping for **newly** created indices. So it won't affect any existing indices (you can delete them if you don't mind losing the data).
You can validate the mappings with:
`GET packetbeat-*/_mapping/field/client_ip`
`GET packetbeat-*/_mapping/field/ip`
And you'll want to see something like:
```auto
"packetbeat-6.6.0-2019.02.21" : {
"mappings" : {
"doc" : {
"client_ip" : {
"full_name" : "client_ip",
"mapping" : {
"ip" : {
"type" : "ip"
}
}
}
}
}
},
```
---
### Author:  [@webmat](https://discuss.elastic.co/u/webmat)
#### Post date: [February 21, 2019, 2:33pm UTC](https://discuss.elastic.co/t/how-to-change-ip-fields-datatype-to-ip-from-keyword-in-packetbeat-6-x/169395/3 "2019-02-21T14:33:36Z")
Note that with the upcoming release of Elastic Stack 7.0, most of the IP fields will have moved to the `ip` datatype, during the transition to the [Elastic Common Schema](https://github.com/elastic/ecs).
---
### Author:  [@sohaibomr](https://discuss.elastic.co/u/sohaibomr)
#### Post date: [February 22, 2019, 9:50am UTC](https://discuss.elastic.co/t/how-to-change-ip-fields-datatype-to-ip-from-keyword-in-packetbeat-6-x/169395/4 "2019-02-22T09:50:35Z")
Thank you 🙂
It works.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 22, 2019, 9:50am UTC](https://discuss.elastic.co/t/how-to-change-ip-fields-datatype-to-ip-from-keyword-in-packetbeat-6-x/169395/5 "2019-03-22T09:50:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.