# Problem in converting string to ip

**URL:** <https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562>\
**Category:** Logstash\
**Created:** [January 24, 2017, 3:31am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562 "2017-01-24T03:31:15Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![satishsnv](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@satishsnv](https://discuss.elastic.co/u/satishsnv)\
**Post date:** [January 24, 2017, 3:31am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/1 "2017-01-24T03:31:15Z")

</div>

Hi i tried to convert string to ip by following the steps provided in the threads but its not working for me. I am getting following error on starting kibana.

08:24:50.444 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Installing elasticsear  
ch template to \_template/logstash  
08:24:50.486 [[main]-pipeline-manager] ERROR logstash.outputs.elasticsearch - Failed to install temp  
late. {:message=\>"Got response code '400' contact Elasticsearch at URL '[http://localhost:9200/\_templ](http://localhost:9200/_templ)  
ate/logstash'", :class=\>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError"}  
08:24:50.488 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - New Elasticsearch outp  
ut {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["localhost:9200"]}

i did created a template.json as below with ip type mentioned.

{  
"template": "logstash-_",  
"settings" : {  
"number\_of\_shards" : 1,  
"number\_of\_replicas" : 0,  
"index" : {  
"query" : { "default\_field" : "@message" },  
"store" : { "compress" : { "stored" : true, "tv": true } }  
}  
},  
"mappings": {  
"default": {  
"\_all": { "enabled": false },  
"\_source": { "compress": true },  
"dynamic\_templates": [  
{  
"string\_template" : {  
"match" : "_",  
"mapping": { "type": "string", "index": "not\_analyzed" },  
"match\_mapping\_type" : "string"  
}  
}  
],  
"properties" : {  
"@fields": { "type": "object", "dynamic": true, "path": "full" },  
"@message" : { "type" : "string", "index" : "analyzed" },  
"@source" : { "type" : "string", "index" : "not\_analyzed" },  
"@source\_host" : { "type" : "string", "index" : "not\_analyzed" },  
"@source\_path" : { "type" : "string", "index" : "not\_analyzed" },  
"@tags": { "type": "string", "index" : "not\_analyzed" },  
"@timestamp" : { "type" : "date", "index" : "not\_analyzed" },  
"@type" : { "type" : "string", "index" : "not\_analyzed" },  
"ipAddress" : {"type" : "ip"}  
}  
}  
}  
}

mentioned following in the output

output {  
stdout { codec =\> "json" }  
elasticsearch{  
hosts =\> ["localhost:9200"]  
template =\> "C:/satish/satish/template.json"  
template\_overwrite =\> true  
codec =\> "json"  
index =\> "logstash-%{secEventType}"  
}  
}

can you help me in resolving this issue?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 24, 2017, 6:52am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/2 "2017-01-24T06:52:03Z")

</div>

I'm surprised there isn't any better error messages in the Logstash log. Have you looked for more clues in the Elasticsearch log?

---

<div class="post-metadata">

**Author:** ![satishsnv](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@satishsnv](https://discuss.elastic.co/u/satishsnv)\
**Post date:** [January 24, 2017, 9:57am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/3 "2017-01-24T09:57:06Z")

</div>

Hi magnus,

i didn't get any info in Elasticsearch log.  
This is the complete log of logstash from console

08:24:50.251 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Elasticsearch pool URL  
s updated {:changes=\>{:removed=\>, :added=\>["[http://localhost:9200](http://localhost:9200)"]}}  
08:24:50.255 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Running health check t  
o see if an Elasticsearch connection is working {:url=\>#\<URI::HTTP:0x68930d0f URL:[http://localhost:9](http://localhost:9)  
200\>, :healthcheck\_path=\>"/"}  
08:24:50.388 [[main]-pipeline-manager] WARN logstash.outputs.elasticsearch - Restored connection to  
ES instance {:url=\>#\<URI::HTTP:0x68930d0f URL:[http://localhost:9200](http://localhost:9200)\>}  
08:24:50.389 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Using mapping template  
from {:path=\>"C:/satish/satish/template.json"}  
08:24:50.438 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Attempting to install  
template {:manage\_template=\>{"template"=\>"logstash-_", "settings"=\>{"number\_of\_shards"=\>1, "number\_o  
f\_replicas"=\>0, "index"=\>{"query"=\>{"default\_field"=\>"@message"}, "store"=\>{"compress"=\>{"stored"=\>t  
rue, "tv"=\>true}}}}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>false}, "\_source"=\>{"compress"=\>  
true}, "dynamic\_templates"=\>[{"string\_template"=\>{"match"=\>"_", "mapping"=\>{"type"=\>"string", "index  
"=\>"not\_analyzed"}, "match\_mapping\_type"=\>"string"}}], "properties"=\>{"@fields"=\>{"type"=\>"object",  
"dynamic"=\>true, "path"=\>"full"}, "@message"=\>{"type"=\>"string", "index"=\>"analyzed"}, "@source"=\>{"  
type"=\>"string", "index"=\>"not\_analyzed"}, "@source\_host"=\>{"type"=\>"string", "index"=\>"not\_analyzed  
"}, "@source\_path"=\>{"type"=\>"string", "index"=\>"not\_analyzed"}, "@tags"=\>{"type"=\>"string", "index"  
=\>"not\_analyzed"}, "@timestamp"=\>{"type"=\>"date", "index"=\>"not\_analyzed"}, "@type"=\>{"type"=\>"strin  
g", "index"=\>"not\_analyzed"}, "ipAddress"=\>{"type"=\>"ip"}}}}}}  
08:24:50.444 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Installing elasticsear  
ch template to \_template/logstash  
08:24:50.486 [[main]-pipeline-manager] ERROR logstash.outputs.elasticsearch - Failed to install temp  
late. {:message=\>"Got response code '400' contact Elasticsearch at URL '[http://localhost:9200/\_templ](http://localhost:9200/_templ)  
ate/logstash'", :class=\>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError"}  
08:24:50.488 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - New Elasticsearch outp  
ut {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["localhost:9200"]}  
08:24:50.491 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=\>"main", "p  
ipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=

> 500}  
> 08:24:50.496 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started  
> {"ipaddress":"169.254.133.10","secEventType":"authentication","messageID":"messageID0","userName":"u  
> serName0","Info":"Info0","tags":["\_dateparsefailure"],"timeStamp":"Tue 2017 Jan 24, 02:36:31:088","p  
> ath":"C:/satish/SecurityEvent-2017-Jan-24.log","@timestamp":"2017-01-24T02:54:50.239Z","info1":"abc0  
> ","@version":"1","host":"L24660WIN","ID":"000891b7-1907-40ed-a1d5-d0a51be07ad3","info2":"xyz0"}{"ipa  
> ddress":"169.254.133.10","secEventType":"dataaccess","messageID":"messageID1","userName":"userName1"  
> ,"Info":"Info1","tags":["\_dateparsefailure"],"timeStamp":"Tue 2017 Jan 24, 02:36:31:089","path":"C:/  
> satish/SecurityEvent-2017-Jan-24.log","@timestamp":"2017-01-24T02:54:50.501Z","info1":"abc1","@versi  
> on":"1","host":"L24660WIN","ID":"ffd1a034-022e-44a5-9aa0-0f9312db8b38","info2":"xyz1"}{"ipaddress":"  
> 169.254.133.10","secEventType":"authentication","messageID":"messageID2","userName":"userName2","Inf  
> o":"Info2","tags":["\_dateparsefailure"],"timeStamp":"Tue 2017 Jan 24, 02:36:31:089","path":"C:/satis  
> h/SecurityEvent-2017-Jan-24.log","@timestamp":"2017-01-24T02:54:50.503Z","info1":"abc2","@version":"  
> 1","host":"L24660WIN","ID":"62331fcc-562b-4bd8-9c5f-b80a860b02ed","info2":"xyz2"}{"ipaddress":"169.2  
> 54.133.10","secEventType":"dataaccess","messageID":"messageID3","userName":"userName3","Info":"Info3  
> ","tags":["\_dateparsefailure"],"timeStamp":"Tue 2017 Jan 24, 02:36:31:089","path":"C:/satish/Securit  
> yEvent-2017-Jan-24.log","@timestamp":"2017-01-24T02:54:50.506Z","info1":"abc3","@version":"1","host"  
> :"L24660WIN","ID":"7bca07ca-cbbf-42ae-b085-0ba1ec2cc7d0","info2":"xyz3"}{"ipaddress":"169.254.133.10  
> ","secEventType":"authentication","messageID":"messageID4","userName":"userName4","Info":"Info4","ta  
> gs":["\_dateparsefailure"],"timeStamp":"Tue 2017 Jan 24, 02:36:31:089","path":"C:/satish/SecurityEven  
> t-2017-Jan-24.log","@timestamp":"2017-01-24T02:54:50.506Z","info1":"abc4","@version":"1","host":"L24  
> 660WIN","ID":"59ad02fb-4f62-411b-ad59-d825ba045a32","info2":"xyz4"}{"ipaddress":"169.254.133.10","se  
> cEventType":"dataaccess","messageID":"messageID5","userName":"userName5","Info":"Info5","tags":["\_da  
> teparsefailure"],"timeStamp":"Tue 2017 Jan 24, 02:36:31:090","path":"C:/satish/SecurityEvent-2017-Ja  
> n-24.log","@timestamp":"2017-01-24T02:54:50.509Z","info1":"abc5","@version":"1","host":"L24660WIN","  
> ID":"e91e31d1-a31f-458c-8b7e-761161f340c1","info2":"xyz5"}{"ipaddress":"169.254.133.10","secEventTyp  
> e":"authentication","messageID":"messageID6","userName":"userName6","Info":"Info6","tags":["\_datepar  
> sefailure"],"timeStamp":"Tue 2017 Jan 24, 02:36:31:090","path":"C:/satish/SecurityEvent-2017-Jan-24.  
> log","@timestamp":"2017-01-24T02:54:50.510Z","info1":"abc6","@version":"1","host":"L24660WIN","ID":"  
> b7d8fc2c-aed0-40a2-87b8-53d5e45a901e","info2":"xyz6"}08:24:50.624 [Api Webserver] INFO logstash.agent - Successfully start  
> ed Logstash API endpoint {:port=\>9600}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 24, 2017, 10:05am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/4 "2017-01-24T10:05:24Z")

</div>

Okay. Then try posting your template file to ES yourself using curl or whatever REST client you prefer to use. Then you'll get any error messages straight from ES.

---

<div class="post-metadata">

**Author:** ![satishsnv](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@satishsnv](https://discuss.elastic.co/u/satishsnv)\
**Post date:** [January 24, 2017, 12:43pm UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/5 "2017-01-24T12:43:57Z")

</div>

hi magnus,  
it resolved finally.  
on doing post it gave errors on certain mappings and types, after resolving them it started working

following is the working template.

{  
"template": "logstash-_",  
"settings" : {  
"number\_of\_shards" : 1,  
"number\_of\_replicas" : 0,  
"index" : {  
"query" : { "default\_field" : "@message" }  
}  
},  
"mappings": {  
"default": {  
"\_all": { "enabled": false },  
"dynamic\_templates": [  
{  
"string\_template" : {  
"match" : "_",  
"mapping": { "type": "string", "index": "not\_analyzed" },  
"match\_mapping\_type" : "string"  
}  
}  
],  
"properties" : {  
"@fields": { "type": "object", "dynamic": true },  
"@message" : { "type" : "string", "index" : "analyzed" },  
"@source" : { "type" : "string", "index" : "not\_analyzed" },  
"@source\_host" : { "type" : "string", "index" : "not\_analyzed" },  
"@source\_path" : { "type" : "string", "index" : "not\_analyzed" },  
"@tags": { "type": "string", "index" : "not\_analyzed" },  
"@timestamp" : { "type" : "date", "index" : "not\_analyzed" },  
"@type" : { "type" : "string", "index" : "not\_analyzed" },  
"ipAddress" : {"type" : "ip", "index" : "analyzed"}  
}  
}  
}  
}  
thanks for the suggestions

---

<div class="post-metadata">

**Author:** ![Habitual](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/habitual/32/14772_2.png) [@Habitual](https://discuss.elastic.co/u/Habitual)\
**Post date:** [January 24, 2017, 2:54pm UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/6 "2017-01-24T14:54:30Z")

</div>

I'm not by any means good at this, yet....  
But this sticks out

> "ipAddress" : {"type" : "ip", "index" : "analyzed"}  
> Shouldn't that be formatted as the others with "@"?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 24, 2017, 7:03pm UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/7 "2017-01-24T19:03:16Z")

</div>

> Shouldn't that be formatted as the others with "@"?

For consistency perhaps, but otherwise no. It's actually quite unusual that @satishsnv has chosen to prefix the fields like that.

---

<div class="post-metadata">

**Author:** ![satishsnv](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@satishsnv](https://discuss.elastic.co/u/satishsnv)\
**Post date:** [January 25, 2017, 6:42am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/8 "2017-01-25T06:42:34Z")

</div>

All the other fields are part of the default template, i have added this ipAddress which is part of log. if i keep @ipAddress, i will get a new field of ip type, but my ipAddress field will remain as string. In order to avoid the creation of new field, i didn't used "@". Does this have any impact?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 25, 2017, 7:08am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/9 "2017-01-25T07:08:07Z")

</div>

> All the other fields are part of the default template,

For Logstash 0.x and maybe early 1.x releases perhaps. The only @ fields in reasonably recent releases are `@timestamp` and `@version`.

> i have added this ipAddress which is part of log. if i keep @ipAddress, i will get a new field of ip type, but my ipAddress field will remain as string. In order to avoid the creation of new field, i didn't used "@". Does this have any impact?

The name itself doesn't matter, but how the field you're using for IP addresses is mapped obviously matters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2017, 7:09am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562/10 "2017-02-22T07:09:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.