Hi Frank, thanks for the reply,
I just checked the mappings (im using the default mappings following ECS standard) and the source.ip field is of type IP.
These are the mappings for everything related to source. in this particular index:
"source" : {
"properties" : {
"address" : {
"type" : "keyword",
"ignore_above" : 1024
},
"as" : {
"properties" : {
"number" : {
"type" : "long"
},
"organization" : {
"properties" : {
"name" : {
"type" : "keyword",
"ignore_above" : 1024,
"fields" : {
"text" : {
"type" : "text",
"norms" : false
}
}
}
}
}
}
},
"bytes" : {
"type" : "long"
},
"domain" : {
"type" : "keyword",
"ignore_above" : 1024
},
"geo" : {
"properties" : {
"city_name" : {
"type" : "keyword",
"ignore_above" : 1024
},
"continent_name" : {
"type" : "keyword",
"ignore_above" : 1024
},
"country_iso_code" : {
"type" : "keyword",
"ignore_above" : 1024
},
"country_name" : {
"type" : "keyword",
"ignore_above" : 1024
},
"location" : {
"type" : "geo_point"
},
"name" : {
"type" : "keyword",
"ignore_above" : 1024
},
"region_iso_code" : {
"type" : "keyword",
"ignore_above" : 1024
},
"region_name" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
"ip" : {
"type" : "ip"
},
"mac" : {
"type" : "keyword",
"ignore_above" : 1024
},
"nat" : {
"properties" : {
"ip" : {
"type" : "ip"
},
"port" : {
"type" : "long"
}
}
},
"packets" : {
"type" : "long"
},
"port" : {
"type" : "long"
},
"registered_domain" : {
"type" : "keyword",
"ignore_above" : 1024
},
"service" : {
"properties" : {
"name" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
"top_level_domain" : {
"type" : "keyword",
"ignore_above" : 1024
},
"user" : {
"properties" : {
"domain" : {
"type" : "keyword",
"ignore_above" : 1024
},
"email" : {
"type" : "keyword",
"ignore_above" : 1024
},
"full_name" : {
"type" : "keyword",
"ignore_above" : 1024,
"fields" : {
"text" : {
"type" : "text",
"norms" : false
}
}
},
"group" : {
"properties" : {
"domain" : {
"type" : "keyword",
"ignore_above" : 1024
},
"id" : {
"type" : "keyword",
"ignore_above" : 1024
},
"name" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
"hash" : {
"type" : "keyword",
"ignore_above" : 1024
},
"id" : {
"type" : "keyword",
"ignore_above" : 1024
},
"name" : {
"type" : "keyword",
"ignore_above" : 1024,
"fields" : {
"text" : {
"type" : "text",
"norms" : false
}
}
}
}
}
}
}
Another thing i noticed is that the generated mappings of this index are generated by filebeat version 7.8.1, could this be an issue?
"perimeter-fw-000411" : {
"mappings" : {
"_meta" : {
"beat" : "filebeat",
"version" : "7.8.1"
}