How to map already fields in a index to ECS fields in elasticsearch

Elastic Stack Elasticsearch
1

Suppose I want to map my ClientIP field to ECS fIeld what is the approach.
The ClientIP filed is already created in the index . Can I map it to ECS field,if the ClientIP field is already created

2

take a look at the alias datatype

3 
PUT siem-test
{
  "mappings": {
    "properties": {
      "ClientIP": {
        "type": "text"
      },
      "client.ip": {
        "type": "alias"
      },
      "transit_mode": {
        "type": "keyword"
      }
    }
  }
}

I am getting following error:

{
  "error": {
    "root_cause": [
      {
        "type": "resource_already_exists_exception",
        "reason": "index [siem-test/GQN9k-6YSpuaCrU0DrdACg] already exists",
        "index_uuid": "GQN9k-6YSpuaCrU0DrdACg",
        "index": "siem-test"
      }
    ],
    "type": "resource_already_exists_exception",
    "reason": "index [siem-test/GQN9k-6YSpuaCrU0DrdACg] already exists",
    "index_uuid": "GQN9k-6YSpuaCrU0DrdACg",
    "index": "siem-test"
  },
  "status": 400
}
4

you have to update the mappings, you cannot recreate the index unless you want to delete it

PUT siem-test/_mappings
{
  "properties": {
    "client.ip": {
      "type": "alias",
      "path": "ClientIP"
    }
  }
}
5

Thank you @spinscale for your help.
But i am getting bellow error now

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "mapper [client] of different type, current_type [text], merged_type [ObjectMapper]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "mapper [client] of different type, current_type [text], merged_type [ObjectMapper]"
  },
  "status": 400
}
6

Thank you @spinscale it worked now

PUT siem-test/_mappings
{
  "properties": {
    "client.ip": {
      "type": "alias",
      "path": "ClientIP.keyword"
    }
  }
}
7

Hii @spinscale the filed name got renamed but then to it is not getting popped up in SIEM APP of elastic

8

Sorry, I am not a heavy SIEM user (yet), you may want to ask this specific question in the SIEM category

--Alex

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.