Need advice - what's the difference between mapping and index pattern?

Elastic Stack Kibana
1

I think I'm a bit lost here.

I created an index with a mapping:

PUT /ip-owner
{
  "mappings" : {
    "properties" : {
      "ip_addr": {
        "type": "ip"
      },
      "customer_number" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "dumptime" : {
        "type" : "date"
      },
      "delisted" : {
        "type" : "boolean"
      },
      "domain" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "host" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "ip_status" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "tenant_name" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      }
    }
  }
}

I can successfully import my data. But now my misunderstanding/newbieness kicks in. I defined a mapping where I define for example that "ip" is of type ip. If I create an index pattern now, "ip" becomes a string.

Which part am I missing? what do I need to do in order for my mapping be reflected in the index pattern?

2

Sorry… I think I got it…

My field was labeld "ip" while I defined a field "ip_addr"…

Stupid mistake…

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.