I’m using the Netwflow UDP input and I just noticed that any field that could simply be an ‘ip’ elasticsearch type is actually just a string type.
My understanding was that elasticsearch should automatically map the correct field type but it seems to prefer string over ip. Is there anyway to force this or do I need to create another field using a pipeline?
what graylog and elasticsearch version are we talking about?
AFAIK the only way to tell elasrticsearch the field is of given type is using custom index mapping
Graylog 3.3
Elasticsearch 6.8.9
I’ll look into custom mapping like maniel suggested.