# Is there any reason to have a field mapped as an IP AND a keyword?

**URL:** https://discuss.elastic.co/t/is-there-any-reason-to-have-a-field-mapped-as-an-ip-and-a-keyword/87801
**Category:** Elasticsearch
**Created:** [May 31, 2017, 7:57pm UTC](https://discuss.elastic.co/t/is-there-any-reason-to-have-a-field-mapped-as-an-ip-and-a-keyword/87801 "2017-05-31T19:57:56Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)
#### Post date: [May 31, 2017, 7:57pm UTC](https://discuss.elastic.co/t/is-there-any-reason-to-have-a-field-mapped-as-an-ip-and-a-keyword/87801/1 "2017-05-31T19:57:56Z")

</div>

I'm looking at a few index mapping examples from around the web and there are a few things Im unsure of.

I have some fields like this that are mapped with IP as well as keyword:

```
"host_ip": {
 "type": "ip",
  "fields": {
    "keyword": {
      "type": "keyword"
    }
  }
},

```

Is there any reason I would want both?

I need it mapped as an IP type so I can search on IP ranges, but when would I want it to be a keyword?

Is searching on a keyword field faster than an IP field? Like for example if I want to query for a specific IP would a query for `host_ip.keyword:<specific ip>` be faster then searching on `host_ip:<specific ip>` (where host\_ip is an IP type)?

---

<div class="post-metadata">

### Author: ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [May 31, 2017, 11:00pm UTC](https://discuss.elastic.co/t/is-there-any-reason-to-have-a-field-mapped-as-an-ip-and-a-keyword/87801/2 "2017-05-31T23:00:15Z")

</div>

I don't see any real use for that. `ip` fields behaves just as `keyword` field in the sense that you can do aggregations over it plus the fact that you can do [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) queries on `ip` fields.

---

<div class="post-metadata">

### Author: ![rusty](https://avatars.discourse-cdn.com/v4/letter/r/f17d59/32.png) [@rusty](https://discuss.elastic.co/u/rusty)
#### Post date: [June 1, 2017, 8:07am UTC](https://discuss.elastic.co/t/is-there-any-reason-to-have-a-field-mapped-as-an-ip-and-a-keyword/87801/3 "2017-06-01T08:07:03Z")

</div>

If you are using exact queries - `ip` type is preferable, but if you need regexp match - `keyword` type is the answer.

---

<div class="post-metadata">

### Author: ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [June 1, 2017, 8:16am UTC](https://discuss.elastic.co/t/is-there-any-reason-to-have-a-field-mapped-as-an-ip-and-a-keyword/87801/4 "2017-06-01T08:16:39Z")

</div>

One aggregation where there is a possible performance benefit is the `significant_terms` aggregation.  
It needs to look up background frequencies to relevance rank candidate terms. An example use case is identifying the IP addresses strongly correlated with risky behaviour [1].  
With a simple `keyword` field Lucene maintains a count that can be looked up cheaply. However, to look up the background frequency for an `ip` type field the internal implementation in significant terms has to effectively run a query to count the set of docs with this value which is more expensive.

[1] [https://www.elastic.co/blog/spotting-bad-actors-what-your-logs-can-tell-you-about-protecting-your-business](https://www.elastic.co/blog/spotting-bad-actors-what-your-logs-can-tell-you-about-protecting-your-business)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2017, 8:16am UTC](https://discuss.elastic.co/t/is-there-any-reason-to-have-a-field-mapped-as-an-ip-and-a-keyword/87801/5 "2017-06-29T08:16:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.