Multi-fields with IP and Keyword Possible?

Hi Gals and Guys,

i was wondering. With multi-fields it is possible to add multiple data types for one field while ingesting everything in to the database.

Currently I have a specific field with the datatype IP, I also want it to have the datatype of keyword to include this field in the rollup. Is this possible?

Could someone include an config example?


Hi michael,

You can manage this with index template.
You may use this example to add a subfield to your field:

  "template": {
    "mappings": {
      "properties": {
        "ip_address": {
          "type": "ip",
            "fields" : {
                "keyword" : {
                  "ignore_above" : 256,
                  "type" : "keyword"


Then you'll have 2 fields:

  • ip_address : ip
  • ip_address.keyword: keyword

Thank you very much worked for me!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.