# Source.ip.keyword insted of source.ip

**URL:** <https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803>\
**Category:** Kibana\
**Created:** [October 12, 2020, 7:06pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803 "2020-10-12T19:06:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [October 12, 2020, 7:06pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803/1 "2020-10-12T19:06:34Z")

</div>

Hello,

I have recently updated my elastic stack from 7.8 to 7.9.2 I had to make something wrong because when I try to do some data visualization when I choose Field for aggregation i see source.ip.keyword instead of source.ip. The field destination.ip works properly. What have I made wrong how can i let kibana see source.ip field? I had checked the documents and they contains this field. I gather data via netflow filebeat module.

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/2441f5ff4d716998d295defa26deb3dbcdbff24d.png)

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [October 14, 2020, 9:18am UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803/2 "2020-10-14T09:18:16Z")

</div>

Hi @Adriann  
seems like that field is not mapped as ip, but was mapped as text and by default also as keyword, could you please check the mappings of the `source.ip` and compare it to the one from the `destination.ip`?

```auto
GET your_index_name/_mapping/field/source.ip
GET your_index_name/_mapping/field/destination.ip

```

---

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [October 15, 2020, 9:39pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803/3 "2020-10-15T21:39:30Z")

</div>

Hi,

thank you for your response. I have checked that for every index that I have and I see that the mapping is all the same. The weird thing is I can use source.ip in KQL query but have the issues mentioned above when I want to use it as a filed name for a chart.

> {  
> "filebeat-netflow-2020.10.07-000001" : {  
> "mappings" : {  
> "source.ip" : {  
> "full\_name" : "source.ip",  
> "mapping" : {  
> "ip" : {  
> "type" : "ip"  
> }  
> }  
> }  
> }  
> },

---

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [October 22, 2020, 2:09pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803/4 "2020-10-22T14:09:47Z")

</div>

Refreshing the index pattern resolved the issue.

> [@Winlogbeat missing mapping fields](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/5):
>
> Hi Adriann, Did you refresh your Kibana index patterns? I do not know the powershell dashboard but I do know the other one (User Management Events) because i was the one I did it. Regarding to winlog.logon.id is a very useful field because it allows you to correlate different events performed by the same user, if it is not in the index pattern is dynamically generated (when you receive an event with that field) . From winlogbeat's Index Template: { "strings\_as\_keyword": { …

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2020, 2:09pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803/5 "2020-11-19T14:09:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.