Keywords for IP fields?

Elastic Stack Elasticsearch
1

Hi all,

by default logstash creates a field and a field.keyword.
When I map e.g. IP fields as fieldtype ip, the ip.keyword field disappears.
Is it usefull to map fields like them with a keyfield again?

E.g.:
[...]
host":{ "type": "ip", "fields":{"keyword": {"type":"keyword","ignore_above": 256}}},
[...]

Regards

2

Like other numeric field types, ip is optimised in the index for performing range queries.
If you want to do things other than range queries e.g. use the significant_terms agg to find IP addresses highly correlated with 404 responses then it is better to use the ip.keyword field for that type of lookup.