Turn Packetbeat IP data from String to IP field type

Elastic Stack Logstash
1

I have been working on logstash to read packetbeat data, however, 90% of the data are strings. I would wanna know how can I turn the fields related to IP address back into the data field as IP.

One of the filters I have done is:

filter{
        geoip{
            source => "ip"
       }
}

But the results haven't changed anything. I have even tried to rewrite the packetbeat template json as stated in GitHub [source]. But no good result. Please help.

Great thanks in advance.

2

You need to modify the index template used by Logstash. Look into the options related to index templates for the elasticsearch output plugin.

3

I can find the elasticsearch output plugin but I am not sure if I should just copy the whole source to overwrite the original data inside the file.
Thanks.

4

Copy the elasticsearch-template.json file (or whatever it's called) into a new location and configure your output to use that file instead.

1 Like
5

Great Thanks. It does a great help.
However, even I have made the logstash conf file to use the template I made from the source, seem the field collected are still all strings instead of changing to other types of data. For example, the ip data collected are originally just a string, then I have mapped it as an IP in the template json file. However, in the setting in Kibana, it is still a string.