# Mapping conflict field host.ip Filebeat

**URL:** <https://discuss.elastic.co/t/mapping-conflict-field-host-ip-filebeat/307535>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 17, 2022, 6:19pm UTC](https://discuss.elastic.co/t/mapping-conflict-field-host-ip-filebeat/307535 "2022-06-17T18:19:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [June 17, 2022, 6:19pm UTC](https://discuss.elastic.co/t/mapping-conflict-field-host-ip-filebeat/307535/1 "2022-06-17T18:19:34Z")

</div>

Hello there,

I got this cluster setup and apparently is working fine apart from that I got some mapping conflicts under the hood.

After added Custom Windows Event Logs integrations using fleet, I checked if logs was coming throught which in fact it was, but then I saw a conflict icon in host.ip field.

Checking the mappings from a few indices, I saw that:

```auto
index: .ds-filebeat-8.2.3-*
"host" : {
          "properties" : {
            "architecture" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
"ip" : {
              "type" : "ip"

```

is conflicting with this one:

```auto
index: .ds-logs-winlog.winlog-default-*
"host" : {
          "properties" : {
            "architecture" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
"ip" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },

```

Also, the results from a simple search using the first index: **.ds-logs-winlog.winlog-default-** \*

```auto
"host": {
      "hostname": "test",
      "os": {
        "build": "14393.4704",
        "kernel": "10.0.14393.4704 (rs1_release.211004-1917)",
        "name": "Windows Server 2016 Standard",
        "type": "windows",
        "family": "windows",
        "version": "10.0",
        "platform": "windows"
      },
      "ip": [
        "169.254.9.134",
        "192.168.0.124",
        "fe80::5efe:a9fe:ac2",
        "fe80::5efe:a82:7c"
      ],

```

The agent.type: filebeat

So my question is, the main issue here is the fact the logs are sending ipv6? Or because the type of one mapping is keyword and the other ip???

So can I fix this?? Should I need to change the whole mapping for the data stream: logs-winlog.winlog-default ???

Thanks for the attention.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2022, 8:19pm UTC](https://discuss.elastic.co/t/mapping-conflict-field-host-ip-filebeat/307535/2 "2022-07-15T20:19:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.