[Solved] Cast/Map IP Field to IP Type

[snkhan]

Hello,

I am a new ELK user, and am trying in vain to cast an existing field containing an IP address to an IP data type. From the copious searches it is clear that I must use mappings, but my attempts to do so have failed.

This is what I have tried so far, using the Dev console:

PUT /myindex/_mapping
{
  "properties": {
    "collected_host": {
      "type": "ip",
      "ignore_malformed": true
    }
  }
}

I have also tried:

PUT myindex
{
  "mappings": {
    "properties": {
      "collected_host": {
        "type": "ip",
        "ignore_malformed": true
      }
    }
  }
}

The error retuned is:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "resource_already_exists_exception",
        "reason" : "index [myindex/wI-2en84RyaNRct_2yzS5Q] already exists",
        "index_uuid" : "wI-2en84RyaNRct_2yzS5Q",
        "index" : "myindex"
      }
    ],
    "type" : "resource_already_exists_exception",
    "reason" : "index [myindex/wI-2en84RyaNRct_2yzS5Q] already exists",
    "index_uuid" : "wI-2en84RyaNRct_2yzS5Q",
    "index" : "myindex"
  },
  "status" : 400
}

I do not mind deleting my index and starting afresh. My preference would be to have this configured in my existing myindex.conf file, but I am happy to try any suggestion to get this working.

Thank you, and have a great day.

[snkhan]

Solved. I deleted my index, re-created it, and then, before importing my documents again, ran the following using the Dev Console:

PUT /myindex/_mapping
{
  "properties": {
    "collected_host": {
      "type": "ip",
      "ignore_malformed": true
    }
  }
}