# IP getting mapped as string
**URL:** https://discuss.elastic.co/t/ip-getting-mapped-as-string/83587
**Category:** Elasticsearch
**Created:** [April 25, 2017, 3:45pm UTC](https://discuss.elastic.co/t/ip-getting-mapped-as-string/83587 "2017-04-25T15:45:48Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@abhi1](https://discuss.elastic.co/u/abhi1)
#### Post date: [April 25, 2017, 3:45pm UTC](https://discuss.elastic.co/t/ip-getting-mapped-as-string/83587/1 "2017-04-25T15:45:49Z")
Hi,
I am new with ELK. I am trying to load a log file via logstash; my log file is in json format. I am able to load it in Elastic, however on closely looking i found out that the ip field is loaded as string instead of IP datatype. I have tried multiple things like using mutate function, template updation ; but nothing seems to be working. Would really appreciate if somebody can help me with this
My config file:
input {
file {
codec =\> json
path =\> "C:\Users\asing178\Downloads\Log\DBAudit.log-2017-04-14-001.json"
start\_position =\> "beginning"
codec =\> json
sincedb\_path =\> "/dev/null"
}
}
output {
elasticsearch {
hosts =\> "[http://localhost:9200](http://localhost:9200)"
#user=\>"elastic"
#password=\>"123456"
index =\> "bi\_hadoop\_log\_abhi"
document\_type =\> "log"
}
stdout { }
}
Json data sample:
{"timestamp":{"$date":"2017-04-12T06:37:44.572Z"},"operation":"DB\_SCAN","user":"sramakr2","uid":43826,"ipAddress":"10.205.82.141","VolumeName":"uhclake\_rx1\_snapshot","volumeId":196457823,"columnFamily":"ci","columnQualifier":"snapshot\_crt\_ts","tablePath":"/datalake/uhclake/tst/t\_hdfs/optum/Enriched/standard\_access/current\_snapshot/rx1/data/CLMPRDEXT2\_RCEX1P\_snaphbase","tableFid":"199722.16724.1003498","status":0}
my updated template file (I have overwritten the default template file)
{
"template" : "logstash-_",
"version" : 50001,
"settings" : {
"index.refresh\_interval" : "5s"
},
"mappings" : {
"default" : {
"\_all" : {"enabled" : true, "norms" : false},
"dynamic\_templates" : [ {
"message\_field" : {
"path\_match" : "message",
"match\_mapping\_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false
}
}
}, {
"string\_fields" : {
"match" : "_",
"match\_mapping\_type" : "string",
"mapping" : {
"type" : "text", "norms" : false,
"fields" : {
"keyword" : { "type": "keyword" }
}
}
}
} ],
"properties" : {
"@timestamp": { "type": "date", "include\_in\_all": false },
"@version": { "type": "keyword", "include\_in\_all": false },
**"ipAddress": { "type": "ip" },**
"geoip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo\_point" },
"latitude" : { "type" : "half\_float" },
"longitude" : { "type" : "half\_float" }
}
}
}
}
}
}
Template file location: C:\Users\asing178\Downloads\logstash-5.2.1\vendor\bundle\jruby\1.9\gems\logstash-output-elasticsearch-6.2.6-java\lib\logstash\outputs\elasticsearch\elasticsearch-template-es5x.json
Kindly let me know if any other detail is required
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 28, 2017, 8:21am UTC](https://discuss.elastic.co/t/ip-getting-mapped-as-string/83587/2 "2017-04-28T08:21:24Z")
You aren't using the geoip filter on the `ipAddress` field, so it will never create that info.
However what does it end up being mapped as?
---
### Author:  [@abhi1](https://discuss.elastic.co/u/abhi1)
#### Post date: [May 1, 2017, 5:59am UTC](https://discuss.elastic.co/t/ip-getting-mapped-as-string/83587/3 "2017-05-01T05:59:59Z")
Thanks Mark...my ip field is getting mapped as string in my indexes. So you are suggesting that i need to use geoip filter in my config
---
### Author:  [@abhi1](https://discuss.elastic.co/u/abhi1)
#### Post date: [May 5, 2017, 3:27pm UTC](https://discuss.elastic.co/t/ip-getting-mapped-as-string/83587/4 "2017-05-05T15:27:17Z")
The issue is resolved now; I have used the explicit mapping for the index where I have specified the field type as ip and then ran the logstash
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 2, 2017, 3:32pm UTC](https://discuss.elastic.co/t/ip-getting-mapped-as-string/83587/5 "2017-06-02T15:32:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.