# Why source.ip.keyword instead source.ip after upgrade

**URL:** <https://discuss.elastic.co/t/why-source-ip-keyword-instead-source-ip-after-upgrade/222579>\
**Category:** Kibana\
**Created:** [March 7, 2020, 9:24pm UTC](https://discuss.elastic.co/t/why-source-ip-keyword-instead-source-ip-after-upgrade/222579 "2020-03-07T21:24:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sasha\_Zn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sasha_zn/32/46350_2.png) [@Sasha\_Zn](https://discuss.elastic.co/u/Sasha_Zn)\
**Post date:** [March 7, 2020, 9:24pm UTC](https://discuss.elastic.co/t/why-source-ip-keyword-instead-source-ip-after-upgrade/222579/1 "2020-03-07T21:24:42Z")

</div>

Hi everyone!  
I upgrade my installation of elastic from 7.6 to 7.6.1 and break my dashboards.  
In my visualizations I used split by Terms=source.ip and now I have error that field not exist.  
Now I can select source.ip.keywords only.  
What this mean?

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [March 12, 2020, 2:57pm UTC](https://discuss.elastic.co/t/why-source-ip-keyword-instead-source-ip-after-upgrade/222579/2 "2020-03-12T14:57:09Z")

</div>

It sounds like a change in mapping of your fields. How did you do your upgrade and did you do any other change with the upgrade (reindex, snapshot restore, etc) ?

---

<div class="post-metadata">

**Author:** ![Sasha\_Zn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sasha_zn/32/46350_2.png) [@Sasha\_Zn](https://discuss.elastic.co/u/Sasha_Zn)\
**Post date:** [April 2, 2020, 6:29pm UTC](https://discuss.elastic.co/t/why-source-ip-keyword-instead-source-ip-after-upgrade/222579/3 "2020-04-02T18:29:11Z")

</div>

Sorry for delay. It's my issue. I had upgrade filebeat before upgrade template mapping in elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2020, 6:29pm UTC](https://discuss.elastic.co/t/why-source-ip-keyword-instead-source-ip-after-upgrade/222579/4 "2020-04-30T18:29:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.