Type mapping question

Elastic Stack Elasticsearch
1

Hi, I collect netflow through logstash, but the IPV4_ADDR field default type is string. I want to mapping the type into "ip" through the API:

PUT _template/logstash
{
  "index_patterns": ["logstash-*"],
  "settings": {
    "number_of_shards": 5
  },
  "mappings": {
    "doc": {
      "_source": {
        "enabled": true
      },
      "properties": {
        "IPV4_SRC_ADDR": { "type": "ip"},
        "IPV4_DST_ADDR": { "type": "ip"},
        "PROTOCOL": { "type": "integer"}
      }
    }
  }
}

but the type is still string unless I delete all the data in ES before I request the mapping API, and the type could turn into "ip".
How could I do to change the type needn't delete all the data?

thank you in advance :slight_smile:

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.