# Source.ip.keyword insted of source.ip

**URL:** <https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803>\
**Category:** Kibana\
**Created:** [October 12, 2020, 7:06pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803 "2020-10-12T19:06:34Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [October 22, 2020, 2:09pm UTC](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803/4 "2020-10-22T14:09:47Z")

</div>

Refreshing the index pattern resolved the issue.

> [@Winlogbeat missing mapping fields](https://discuss.elastic.co/t/winlogbeat-missing-mapping-fields/252846/5):
>
> Hi Adriann, Did you refresh your Kibana index patterns? I do not know the powershell dashboard but I do know the other one (User Management Events) because i was the one I did it. Regarding to winlog.logon.id is a very useful field because it allows you to correlate different events performed by the same user, if it is not in the index pattern is dynamically generated (when you receive an event with that field) . From winlogbeat's Index Template: { "strings\_as\_keyword": { …

---

_[View the full topic](https://discuss.elastic.co/t/source-ip-keyword-insted-of-source-ip/251803)._