# If-Else in an Index Template, and How Smart is the IP Field?

**URL:** <https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496>\
**Category:** Elasticsearch\
**Created:** [June 17, 2020, 3:07pm UTC](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496 "2020-06-17T15:07:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [June 17, 2020, 3:07pm UTC](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496/1 "2020-06-17T15:07:15Z")

</div>

Hi Elasticsearch Jedi Masters,

I have an Elasticsearch instance (ver 7.7.1) that is archiving network data. I also have an index template transforming the data type of the “IP.host” field from text string to IP address:

```
curl -X PUT "localhost:9200/_template/my_template" -H 'Content-Type: application/json' -d'
{
  "index_patterns": "myindex",
  "order": 1,
  "settings": {
    "index": {
      "refresh_interval": "5s"
    }
  },
  "mappings": {
    "properties": {
      "IP.host": {
        "type": "ip"
      }
    }
  }
}'

```

A colleague pointed out that my Elasticsearch will need to handle both IPv4 and IPv6 addresses. I hadn’t thought of that! The Elasticsearch documentation ([here](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html)) says that “_An ip field can index/store either IPv4 or IPv6 addresses._” Does this mean I don’t have to worry about the v4/v6 distinction, that Elasticsearch will be smart enough to tell that “_ **10.10.10.10** _” is a v4 address and “_ **FC00:CAFE:1890:00A0:0722:2000:0000:0063** _” is a v6 address? That seems almost too good to be true.

My data does have a field indicating IPv4 or v6. If I must, can I do some kind of if/else within the index template, something like this:

```
curl -X PUT "localhost:9200/_template/my_template" -H 'Content-Type: application/json' -d'
{
  "index_patterns": "myindex",
  "order": 1,
  "settings": {
    "index": {
      "refresh_interval": "5s"
    }
  },
  if "IP.version" == 4 {
    "mappings": {
      "properties": {
        "IP.host": {
          "type": "ip"
        }
      }
    }
  },
  else {
    # "type": "ipv6"
  },
}'

```

Is this possible? If so, can someone show me an example of the syntax? Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2020, 3:07pm UTC](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496/2 "2020-07-15T15:07:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.