# Keywords for IP fields?
**URL:** https://discuss.elastic.co/t/keywords-for-ip-fields/139144
**Category:** Elasticsearch
**Created:** [July 9, 2018, 10:54am UTC](https://discuss.elastic.co/t/keywords-for-ip-fields/139144 "2018-07-09T10:54:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)
#### Post date: [July 9, 2018, 10:54am UTC](https://discuss.elastic.co/t/keywords-for-ip-fields/139144/1 "2018-07-09T10:54:41Z")
Hi all,
by default logstash creates a field and a field.keyword.
When I map e.g. IP fields as fieldtype ip, the ip.keyword field disappears.
Is it usefull to map fields like them with a keyfield again?
E.g.:
[...]
host":{ "type": "ip", "fields":{"keyword": {"type":"keyword","ignore\_above": 256}}},
[...]
Regards
---
### Author:  [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)
#### Post date: [July 10, 2018, 9:16am UTC](https://discuss.elastic.co/t/keywords-for-ip-fields/139144/2 "2018-07-10T09:16:15Z")
> [@MarcusCaepio](#):
>
> Is it usefull to map fields like them with a keyfield again?
Like other numeric field types, ip is optimised in the index for performing range queries.
If you want to do things other than range queries e.g. use the significant\_terms agg to find IP addresses highly correlated with 404 responses then it is better to use the `ip.keyword` field for that type of lookup.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 7, 2018, 9:16am UTC](https://discuss.elastic.co/t/keywords-for-ip-fields/139144/3 "2018-08-07T09:16:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.