Mapping to add multi_fileds

I have an index (whitelist) so defined

{
  "mapping": {
    "_doc": {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "network": {
          "type": "ip_range"
        }
      }
    }
  }
}

I need to update network field to support multi_fileds, i.e. I need that this index changes in:

{
  "mapping": {
    "_doc": {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "network": {
          "type": "ip_range"
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    }
  }
}

How can I use _mapping api to do this?
I tried unsuccessfully with command like this one (and different variants), but all return errors.

curl -X PUT "<machine>:9200/whitelist/_mapping" -H 'Content-Type: application/json' -d '
{      
	  "properties": {
	    "network":{"type":"ip_range","ignore_above":256}
		}
	}	
}
'

Something like this should work:

curl -XPUT "http://localhost:9200/whitelist/_mapping/_doc" -H 'Content-Type: application/json' -d'
{
  "properties": {
    "network": {
      "type": "ip_range",
      "fields": {
        "keyword": {
          "type": "keyword",
          "ignore_above": 256
        }
      }
    }
  }
}'

Thanks so much Abdon.
It works!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.