# IP address mapping conflict

**URL:** <https://discuss.elastic.co/t/ip-address-mapping-conflict/76436>\
**Category:** Kibana\
**Created:** [February 24, 2017, 6:31pm UTC](https://discuss.elastic.co/t/ip-address-mapping-conflict/76436 "2017-02-24T18:31:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![marky](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@marky](https://discuss.elastic.co/u/marky)\
**Post date:** [February 24, 2017, 6:31pm UTC](https://discuss.elastic.co/t/ip-address-mapping-conflict/76436/1 "2017-02-24T18:31:21Z")

</div>

Hi,

I tried searching for a solution to this but I wasn't able to get very far. I'm importing numerous JSON documents that contain various logs (AWS cloudtrail logs in this case) into Elasticsearch and then using Kibana to search them. I am not using logstash for this.

There is a field titled "sourceIPAddress" which is defined in all the index mappings as:

```
"sourceIPAddress" : {
    "type" : "ip"
}

```

This works for indexing and searching in Kibana, however Kibana states that this field is in conflict.

The index patterns page says that it changes in some indices but I'm unable to find the indices where it doesn't work. The only thing I can think of is that some events have no ' sourceIPAddress' field set at all but that doesn't seem like it should break my ability to use visualize on it.

Can anybody offer some guidance?

---

<div class="post-metadata">

**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\
**Post date:** [February 24, 2017, 10:01pm UTC](https://discuss.elastic.co/t/ip-address-mapping-conflict/76436/2 "2017-02-24T22:01:40Z")

</div>

Hi Marky, from a quick Google search for "kibana field conflict", I found these links which sound like the same thing you're describing:

> [@Mapping conflict!](https://discuss.elastic.co/t/mapping-conflict/40248):
>
> Dear community, I have a mapping conflicts in across our indices (separated on a daily basis): Mapping conflict! A field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict fields in parts of Kibana, but they will be unavailable for functions that require Kibana to know their type. Correcting this issue will require re-indexing your data. Yesterday I changed via logstash % {NUMBER: bytes: int} a f…

> [@How to fix mapping conflict?](https://discuss.elastic.co/t/how-to-fix-mapping-conflict/55072):
>
> I have a few fields (bytesSent, bytesReceived, timetaken) that show mapping conflicts, and thus I cannot visualize them in Kibana. All of these log entries are going to an index "logstash-\*" I am pretty green at this, so how would I go about finding all of the conflicting indexes and fixing or removing them? Here is part of the grok expression used for these conflicting fields in Logstash: %{NUMBER:bytesSent} %{NUMBER:bytesReceived} %{NUMBER:timetaken} And then a mutate (is this even necess…

> <https://github.com/elastic/kibana/issues/2505#issuecomment-157613935>
>
> Mapping conflict! 14 fields are defined as several types (string, integer, etc) …across the indices that match this pattern. You may still be able to use these conflict fields in parts of Kibana, but they will be unavailable for functions that require Kibana to know their type. Correcting this issue will require reindexing your data. 
> 
> Use the following command to create an index.
> \# 
> 
> curl -XPUT localhost:9200/\_river/my\_csv\_river/\_meta -d'
> {
> "type" : "csv",
> "csv\_file" : {
> "folder" : "/home/paqs/Downloads/kibana/hun",
> "filename\_pattern" : ".\*\\.csv$",
> "poll":"1m",
> "fields" : \[
> "SiNo",
> "UserId",
> "UserName",
> "Time",
> "Latitude",
> "Longitude",
> "Sublocation",
> "Location",
> "State",
> "Country",
> "Temperature",
> "Prefferedtemp",
> "AvgPtemp",
> "Humidity",
> "AvgHum",
> "Pollution",
> "AvgPollution",
> "Dust",
> "Davg"
> \],
> "first\_line\_is\_header" : "false",
> "field\_separator" : ",",
> "escape\_character" : "\\",
> "quote\_character" : "\\"",
> "field\_id" : "id",
> "field\_timestamp" : "imported\_at",
> "concurrent\_requests" : "1",
> "charset" : "UTF-8",
> "script\_before\_file": "/home/paqs/Downloads/kibana/hun/before\_file.sh",
> "script\_after\_file": "/home/paqs/Downloads/kibana/hun/after\_file.sh",
> "script\_before\_all": "/home/paqs/Downloads/kibana/hun/before\_all.sh",
> "script\_after\_all": "/home/paqs/Downloads/kibana/hun/after\_all.sh"
> },
> "index" : {
> "index" : "han",
> "type" : "chal",
> "bulk\_size" : 1000,
> "bulk\_threshold" : 10
> }
> }'
> 
> curl -XPUT http://localhost:9200/han -d '
> {
> "settings" : {
> "number\_of\_shards" : 1
> },
> "mappings" : {
> "alert" : {
> "properties" : {
> "UserName" : {"type" : "string", "index" : "not\_analyzed"},
> "Sublocation" : {"type" : "string", "index" : "not\_analyzed"},
> "Location" : {"type" : "string", "index" : "not\_analyzed"},
> "State" : {"type" : "string", "index" : "not\_analyzed"},
> "Country" : {"type" : "string", "index" : "not\_analyzed"},
> "Time" : {"type" : "date", "ignore\_malformed" : true, "format" : "dateOptionalTime"},
> "Pollution" : {"type" : "integer"},
> "Dust" : {"type" : "integer"},
> "UserId" : {"type" : "integer"},
> "SiNo" : {"type" : "long"},
> "Humidity" : {"type" : "double"},
> "Prefferedtemp" : {"type" : "double"},
> "Temperature" : {"type" : "double"},
> "AvgHum" : {"type" : "double"},
> "AvgPtemp" : {"type" : "double"},
> "AvgPollution" : {"type" : "double"},
> "Davg" : {"type" : "double"},
> "Latitude" : {"type" : "double"},
> "Longitude" : {"type" : "double"}
> }
> }
> }
> }'
> 
> 5)
> This is my csv file contains these value 
> example row\[1\]:-------"342379","875","Testaasim","1412294400","12.9289196","77.6352281"," Koramangala","Bengaluru","Karnataka","India","33.6","23","23.177777777778","54.6","54.722222222222","858","847","0","824.88888888889"
> Row\[2\]:------ "350214","875","Testaasim","1412294400","12.928922","77.6352343"," Koramangala "," Bengaluru","Karnataka"," India","33.3","23","23.177777777778","54.5","54.722222222222","580","847","6681","824.88888888889"
> 
> y the confilt error is occuring did i need to change any thing in index or mapping ..plzz some one resolve this confilt ....

> <https://stackoverflow.com/questions/38474978/how-to-find-fields-with-mapping-conflicts>

[https://dev.sobeslavsky.net/kibana-how-to-solve-mapping-conflict/](https://dev.sobeslavsky.net/kibana-how-to-solve-mapping-conflict/)

The common answer to this problem is to reindex your data. Please try that and let me know if it helps!

Thanks,  
CJ

---

<div class="post-metadata">

**Author:** ![marky](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@marky](https://discuss.elastic.co/u/marky)\
**Post date:** [February 27, 2017, 5:06pm UTC](https://discuss.elastic.co/t/ip-address-mapping-conflict/76436/3 "2017-02-27T17:06:56Z")

</div>

Hi CJ,

Thanks for the response. I'm curious if there's a way to identify which document(s) caused the mapping conflict to begin with. Do you know of any ways to identify what document(s) or even indices may have caused the conflict?

---

<div class="post-metadata">

**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\
**Post date:** [March 1, 2017, 12:56am UTC](https://discuss.elastic.co/t/ip-address-mapping-conflict/76436/4 "2017-03-01T00:56:51Z")

</div>

Unfortunately, there's no easy way to do that, from what I can tell.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2017, 12:56am UTC](https://discuss.elastic.co/t/ip-address-mapping-conflict/76436/5 "2017-03-29T00:56:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.