# Mapping questions
**URL:** https://discuss.elastic.co/t/mapping-questions/44936
**Category:** Elasticsearch
**Created:** [March 20, 2016, 7:45pm UTC](https://discuss.elastic.co/t/mapping-questions/44936 "2016-03-20T19:45:07Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@broerman](https://discuss.elastic.co/u/broerman)
#### Post date: [March 20, 2016, 7:45pm UTC](https://discuss.elastic.co/t/mapping-questions/44936/1 "2016-03-20T19:45:08Z")
Hello,
I try to analyse loggimg output of iptables, which can be grokked by logstash with kv filter.
For example
"IN" =\> "eth0",
"SRC" =\> "10.10.10.10",
"DST" =\> "192.168.100.100",
"PROTO" =\> "TCP",
"SPT" =\> "43852",
"DPT" =\> "22",
How can I make these fields analysable with kibana / elasticsearch?
Appendix:
My setup
filebeat
-
paths:
- /var/log/iptables.log
input\_type: log
document\_type: netfilter
logstash 2.2.2:
input {
beats { port =\> 5044 }
}
filter {
if [type] == "netfilter" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
}
kv {
source =\> "syslog\_message"
include\_keys =\> ["IN" , "OUT" , "SRC" , "DST" , "PROTO" , "SPT" , "DPT"]
}
```
geoip {
source => "SRC"
database => "/etc/logstash/GeoLiteCity.dat"
}
date {
locale => "en"
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
```
}
}
output {
stdout { codec =\> rubydebug }
elasticsearch {
hosts =\> "localhost:9200"
}
}
elasticsearch 2.2.
The properties of mapping I can query but I don't know how to change it . DPT,DST,SRC,SPT.. for each index separatly or can I define an global behavior?
curl -s -XGET '[http://localhost:9200/logstash-2016.03.17](http://localhost:9200/logstash-2016.03.17)' | jq '.[] | .mappings.netfilter.properties'
"DPT": {
"type": "string",
"norms": {
"enabled": false
},
"fielddata": {
"format": "disabled"
},
"fields": {
"raw": {
"type": "string",
"index": "not\_analyzed",
"doc\_values": true,
"ignore\_above": 256
}
}
},
I found a lot of explanations in the web , but I didn't find a consistent example . Perhaps sombody can help me.
Thank you
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 20, 2016, 8:52pm UTC](https://discuss.elastic.co/t/mapping-questions/44936/2 "2016-03-20T20:52:38Z")
You'll want to modify Logstash's default index template so that the IP address fields are mapped as the ip type and the port number fields are mapped as integers. Have a look at the template-related options for Logstash's [elasticsearch output](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:06pm UTC](https://discuss.elastic.co/t/mapping-questions/44936/3 "2017-07-05T23:06:44Z")