How to Map IP type

Elastic Stack Elasticsearch
1

this is my IPV4_DST_ADDR field mapping:

"IPV4_DST_ADDR":{"type":"text","norms":false,"fields":{"keyword":{"type":"keyword","ignore_above":256}}}

I want to change the type from text to IP, how can I do?

thank you in advance!

2

Hi @f26227279,

You can use the "type": "ip", please take a look in the following example taken from docs:

PUT my_index
{
  "mappings": {
    "my_type": {
      "properties": {
        "IPV4_DST_ADDR": {
          "type": "ip"
        }
      }
    }
  }
}

PUT my_index/my_type/1
{
  "IPV4_DST_ADDR": "192.168.1.1"
}

GET my_index/_search
{
  "query": {
    "term": {
      "IPV4_DST_ADDR": "192.168.0.0/16"
    }
  }
}

Hope it helps.

Cheers,
LG

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.