# OSQuery Manager Integration Mapping IP (\`host.ip\`) as Keyword

**URL:** <https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225>\
**Category:** Beats\
**Tags:** fleet, elastic-agent, osquery-manager\
**Created:** [September 2, 2021, 11:42pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225 "2021-09-02T23:42:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [September 2, 2021, 11:42pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225/1 "2021-09-02T23:42:58Z")

</div>

Hi All,

I'm using Fleet with the OSQuery Manager integration for 7.14.0, and I noticed that the data stream it created `logs-osquery_manager.result-default` is mapping the `host.ip` field as a keyword. This is causing an issue in Kibana as its causing a mapping conflict within the Kibana Index Pattern `logs-*`, as `host.ip` is supposed to be mapped as an IP according to [ECS](https://www.elastic.co/guide/en/ecs/current/ecs-host.html#field-host-ip).

Example:

`GET /.ds-logs-osquery_manager.result-default-2021.08.25-000001/_mapping/field/host.ip`

```json
{
  ".ds-logs-osquery_manager.result-default-2021.08.25-000001" : {
    "mappings" : {
      "host.ip" : {
        "full_name" : "host.ip",
        "mapping" : {
          "ip" : {
            "type" : "keyword",
            "ignore_above" : 1024
          }
        }
      }
    }
  }
}

```

Would anyone know why this is or how to fix it?

This field seems to being created when a result is returned from a query via OSQuery.

Looking at the index pattern `logs-osquery_manager.result`, it appears that `host.ip` isn't mapped, and the dynamic setting only allows mapping everything to keywords:

```json
"dynamic_templates": [
  {
    "strings_as_keyword": {
      "mapping": {
        "ignore_above": 1024,
        "type": "keyword"
      },
      "match_mapping_type": "string"
    }
  }
]

```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 3, 2021, 11:27am UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225/2 "2021-09-03T11:27:14Z")

</div>

As you pointed out, it is likely missing in the mappings: [https://github.com/elastic/integrations/blob/master/packages/osquery\_manager/data\_stream/result/fields/osquery.yml](https://github.com/elastic/integrations/blob/master/packages/osquery_manager/data_stream/result/fields/osquery.yml)

@aleksmaus To not have to map all fields, maybe a dynamic mapping that matches \*.ip could be used?

---

<div class="post-metadata">

**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\
**Post date:** [September 3, 2021, 11:50am UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225/3 "2021-09-03T11:50:36Z")

</div>

Thank you for reporting this issue.  
Yes, seems like there are more mappings that need to be defined. We will address that in the next versions of the integration package.

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [September 3, 2021, 12:02pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225/4 "2021-09-03T12:02:42Z")

</div>

@aleksmaus @ruflin thanks for the information. I've found a few similar issues with some of the other integrations. Is there a better place to report these mapping issues, or should I just open up additional forum topics?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 3, 2021, 12:25pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225/5 "2021-09-03T12:25:50Z")

</div>

If you see mapping issues, best directly open a github issue in [https://github.com/elastic/integrations](https://github.com/elastic/integrations) Thanks for reporting these!

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [September 3, 2021, 12:33pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225/6 "2021-09-03T12:33:16Z")

</div>

Will do, thanks @ruflin

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2021, 2:33pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-mapping-ip-host-ip-as-keyword/283225/7 "2021-10-01T14:33:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.