# "reason":"'?' is not an IP string literal

**URL:** <https://discuss.elastic.co/t/reason-is-not-an-ip-string-literal/211750>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [December 13, 2019, 6:58am UTC](https://discuss.elastic.co/t/reason-is-not-an-ip-string-literal/211750 "2019-12-13T06:58:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RoNo](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@RoNo](https://discuss.elastic.co/u/RoNo)\
**Post date:** [December 13, 2019, 6:58am UTC](https://discuss.elastic.co/t/reason-is-not-an-ip-string-literal/211750/1 "2019-12-13T06:58:10Z")

</div>

Hello.

I am running elkstack with Filebeat with module auditd and using the pipeline `filebeat-7.3.0-auditd-log-pipeline`  
a lot of my logs related to docker ends up in the DLQ with the following message.

> `{"level":"WARN","loggerName":"logstash.outputs.elasticsearch","timeMillis":1576067343909,"thread":"[main]\>worker0","logEvent":{"message":"Could not index event to Elasticsearch.","status":400,"action":["index",{"\_index":"filebeat-7.3.0","\_type":"\_doc","pipeline":"filebeat-7.3.0-auditd-log-pipeline"},{"metaClass":{"metaClass":{"metaClass":{"action":"["index", {:\_id=\>nil, :\_index=\>"filebeat-7.3.0", :\_type=\>"\_doc", :routing=\>nil, :pipeline=\>"filebeat-7.3.0-auditd-log-pipeline"}, #LogStash::Event:0x171cda88]","response":{"index":{"\_index":"filebeat-7.3.0-000016","\_type":"\_doc","\_id":"7U3v9G4BybKVV4KXJVZ0","status":400,"error":{"type":"mapper\_parsing\_exception","reason":"failed to parse field [auditd.log.addr] of type [ip] in document with id '7U3v9G4BybKVV4KXJVZ0'","caused\_by":{"type":"illegal\_argument\_exception","reason":"'?' is not an IP string literal."}}}}}}}}]}}

`

Does anybody know how I can resolve this?

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [December 13, 2019, 9:54am UTC](https://discuss.elastic.co/t/reason-is-not-an-ip-string-literal/211750/2 "2019-12-13T09:54:13Z")

</div>

Hi it looks like a mapping problem.

Could you check in the events that are sent by Filebeat what is inside `auditd.log.addr` field. Elasticsearch complains that what is sent `is not an IP string literal`.

---

<div class="post-metadata">

**Author:** ![RoNo](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@RoNo](https://discuss.elastic.co/u/RoNo)\
**Post date:** [December 13, 2019, 10:14am UTC](https://discuss.elastic.co/t/reason-is-not-an-ip-string-literal/211750/3 "2019-12-13T10:14:17Z")

</div>

I suspect its because how docker interacts with auditd.  
I am seeing the following

`type=VIRT_CONTROL msg=audit(1574942196.355:3871474): pid=9724 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:container_runtime_t:s0 msg='op=start vm=? vm-pid=? ctr_id_short=? reason=api user=? auid=4294967295 exe=? hostname=? exe="/usr/bin/dockerd-current" hostname=? addr=? terminal=? res=success' `  
I suspect this is how docker is interacting with auditd and would need to make an addition to the Filebeat pipeline for auditd.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2020, 10:14am UTC](https://discuss.elastic.co/t/reason-is-not-an-ip-string-literal/211750/4 "2020-01-10T10:14:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.