Multi-fields with IP and Keyword Possible?

[michaelpietzsch]

Hi Gals and Guys,

i was wondering. With multi-fields it is possible to add multiple data types for one field while ingesting everything in to the database.

Currently I have a specific field with the datatype IP, I also want it to have the datatype of keyword to include this field in the rollup. Is this possible?

Could someone include an config example?

Regards
Michael

[Rom1]

Hi michael,

You can manage this with index template.
You may use this example to add a subfield to your field:

  "template": {
    "mappings": {
      "properties": {
        "ip_address": {
          "type": "ip",
            "fields" : {
                "keyword" : {
                  "ignore_above" : 256,
                  "type" : "keyword"
                }
              }

        }
      }
    }
  }

Then you'll have 2 fields:

• ip_address : ip
• ip_address.keyword: keyword

[michaelpietzsch]

Thank you very much worked for me!