# IP type being incorrectly indexed and mapped as string **URL:** \ **Category:** Elasticsearch\ **Created:** [February 8, 2017, 10:20pm UTC](https://discuss.elastic.co/t/ip-type-being-incorrectly-indexed-and-mapped-as-string/74437 "2017-02-08T22:20:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![bohearne\_flp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bohearne_flp/32/15314_2.png) [@bohearne\_flp](https://discuss.elastic.co/u/bohearne_flp)\ **Post date:** [February 8, 2017, 10:20pm UTC](https://discuss.elastic.co/t/ip-type-being-incorrectly-indexed-and-mapped-as-string/74437/1 "2017-02-08T22:20:53Z")
I have a Logstash config file that has defined a field mapping of an IP-type field as follows: ... %{IP:client\_ip} ... but when my data (an AWS ELB log file) is consumed by Logstash and indexed in Elasticsearch, my data is coming over as a string type. Specifically, when queried, the Elasticsearch mapping for that field shows as follows: ... "client\_ip" : { "type" : "text", "norms" : false, "fields" : { "keyword" : { "type" : "keyword" } } }, ... I haven't specified anything like the Elasticsearch mapping anywhere, and I've checked the grok documentation and it appears the declaration of an IP type is correct. How do I ensure that my IP fields get mapped / typed properly in Elasticsearch? (Note that the next job will be to fix over a month's worth of data in Elasticsearch, since you apparently cannot change data types for existing mappings...) Thanks for your help... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 8, 2017, 10:20pm UTC](https://discuss.elastic.co/t/ip-type-being-incorrectly-indexed-and-mapped-as-string/74437/2 "2017-03-08T22:20:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.