Hi all,
I am using filebeat on different hosts but on one of them a conflict has appeared for the host.ip field.
This field appears to have the types: ip and text. This happens because both the IPv4 and IPv6 versions appear (10.x.x.x and fe80:::xx:xx...:xx)
I know that this would be solved by reindexing, but what format should I give this field to be able to use it correctly and take into account both possible values? My idea would be to use the Security rules and if this conflict exists it would not be possible... what would be the best way to solve it?
Apparently this has also happened in the next post, but it was fixed by removing the IPv6 version of the host, which I can't do...
It also want to ask this problem in a generic way... if any other field has a conflict between the field value (ip, date, long or others...) and the type text. How could I solve it so that it would allow me to apply filters, rules, views of the Security feature?
Thanks
Regards