Supported Elasticsearch Field Types

Hi all,

I found an old thread from 2018 here, which was not answered:

I tried to use field type “ip” in a GROK rule, but got the error message “not supported”. We use ES 6.8.6 on our ES cluster members.
According to this page (, the type “ip” is nothing special.

Do you have an overview which datatypes are supported in GL? A hint with the GitHub source would be enough for me.



Found this:
The type “ip” is there:
IP: createType('ip', [Properties.Enumerable]),
Now I’m even more confused…

Hi @shenke,

What do you mean by:

tried to use field type “ip” in a GROK rule

Can you give an example for that? Because GROK does not support the type IP.

I wanted to change the field %{Client_IP:src_ip} to %{Client_IP:src_ip;ip} which did not work.

This is the full extractor:

Hello @shenke,

GROK does not know a type IP and does not know of the elasticsearch field types.
GROK only knows int, float, string and perhaps boolean but I could not find anything about that.

As far as I know, sending a string to elastic search should be enough and elastic search will map it as IP if you configured it that way.

Hmkay, I’ll try it that way. Thank you!

I just read again what I wrote and I want to make my self clear. It should be enough to do no type casting in the Grok Pattern at all.

Hope this helps! Let me know if I can be of any further help.

Best regards,

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.