# Need help with filebeat index pattern - Mapping conflict with host.ip **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 26, 2021, 10:28pm UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673 "2021-07-26T22:28:04Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Cdnvballer](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Post date:** [July 26, 2021, 10:28pm UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/1 "2021-07-26T22:28:04Z")
filebeat index pattern shows warning that host.ip is showing both type ip and text. I believe this is somehow related to IPv6 host.ip is in type text and IPv4 host.ip in type ip how do fix this ? at this point I don't need IPv6 detail(s). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 26, 2021, 10:31pm UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/2 "2021-07-26T22:31:58Z")
That sounds possible, yes. Are the v4 and v6 values stored in the same field? ---
**Author:** ![Cdnvballer](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Post date:** [July 27, 2021, 2:53am UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/3 "2021-07-27T02:53:24Z")
yes it appears to be so, from Observability --\> Logs --\> an entry's detail would show field host.ip with both IPv4 address and what looks to be IPv6 IP address. seems like my old grok patterns (worked in 6.8.x) aren't working on 7.1.3.x .. still trying to figure that out too.. but with this Mapping Conflict, I can't seem to run a reload on the index pattern (not available option, just delete index pattern) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 27, 2021, 4:25am UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/4 "2021-07-27T04:25:50Z")
What do you mean by a reload there? ---
**Author:** ![Cdnvballer](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Post date:** [July 27, 2021, 4:37am UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/5 "2021-07-27T04:37:09Z")
Typo, meant there is no icon/option to refresh the index pattern... ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 27, 2021, 5:37am UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/6 "2021-07-27T05:37:45Z")
Ah ok. That won't fix it because you will need to reindex the data with the "bad" mapping to the "good" one. Or, delete that "bad" data. ---
**Author:** ![Cdnvballer](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Post date:** [July 27, 2021, 3:45pm UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/7 "2021-07-27T15:45:15Z")
I've tried deleting the bad data/(filebeat-\* indexes) , but the mapping keeps coming back even on new data. i.e. field host.ip value 10.XX.XX.XXX, fe80::da9d:67ff:fe2b:b574 I managed to disable ipv6 from the OS side, and live data no longer shows a host.ip value with both IPv4 and IPv6... but index pattern still shows the mapping conflict. in the mapping json, I see 2 entries where ip is type text instead of type ip. not familiar with the reindexing process. can someone explain how it's done? via dev-tool console? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 2, 2021, 10:18pm UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/8 "2021-08-02T22:18:45Z")
> [@Cdnvballer](#): > > in the mapping json, I see 2 entries where ip is type text instead of type ip. Are they specific indices you can delete? > [@Cdnvballer](#): > > I managed to disable ipv6 from the OS side, and live data no longer shows a host.ip value with both IPv4 and IPv6 Awesome! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 31, 2021, 12:18am UTC](https://discuss.elastic.co/t/need-help-with-filebeat-index-pattern-mapping-conflict-with-host-ip/279673/9 "2021-08-31T00:18:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.