# Turn Packetbeat IP data from String to IP field type
**URL:** https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546
**Category:** Logstash
**Created:** [June 1, 2016, 10:31am UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546 "2016-06-01T10:31:15Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)
#### Post date: [June 1, 2016, 10:31am UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546/1 "2016-06-01T10:31:15Z")
I have been working on logstash to read packetbeat data, however, 90% of the data are strings. I would wanna know how can I turn the fields related to IP address back into the data field as IP.
One of the filters I have done is:
```
filter{
geoip{
source => "ip"
}
}
```
But the results haven't changed anything. I have even tried to rewrite the packetbeat template json as stated in GitHub [source]. But no good result. Please help.
Great thanks in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 1, 2016, 12:10pm UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546/2 "2016-06-01T12:10:15Z")
You need to modify the index template used by Logstash. Look into the options related to index templates for the elasticsearch output plugin.
---
### Author:  [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)
#### Post date: [June 1, 2016, 1:30pm UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546/3 "2016-06-01T13:30:58Z")
I can find the elasticsearch output plugin but I am not sure if I should just copy the whole [source](https://github.com/elastic/beats/blob/master/packetbeat/packetbeat.template-es2x.json) to overwrite the original data inside the file.
Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 1, 2016, 2:23pm UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546/4 "2016-06-01T14:23:29Z")
Copy the elasticsearch-template.json file (or whatever it's called) into a new location and configure your output to use that file instead.
---
### Author:  [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)
#### Post date: [June 1, 2016, 2:27pm UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546/5 "2016-06-01T14:27:54Z")
Great Thanks. It does a great help.
However, even I have made the logstash conf file to use the template I made from the source, seem the field collected are still all strings instead of changing to other types of data. For example, the ip data collected are originally just a string, then I have mapped it as an IP in the template json file. However, in the setting in Kibana, it is still a string.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546/6 "2017-07-06T04:54:53Z")