Keywords for IP fields?

Hi all,

by default logstash creates a field and a field.keyword.
When I map e.g. IP fields as fieldtype ip, the ip.keyword field disappears.
Is it usefull to map fields like them with a keyfield again?

E.g.:
[...]
host":{ "type": "ip", "fields":{"keyword": {"type":"keyword","ignore_above": 256}}},
[...]

Regards

Like other numeric field types, ip is optimised in the index for performing range queries.
If you want to do things other than range queries e.g. use the significant_terms agg to find IP addresses highly correlated with 404 responses then it is better to use the ip.keyword field for that type of lookup.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.