# Indexing with an IP type caused error

**URL:** <https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302>\
**Category:** OpenDistro\
**Created:** [June 22, 2021, 3:50am UTC](https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302 "2021-06-22T03:50:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![flyhigh72](https://avatars.discourse-cdn.com/v4/letter/f/a87d85/32.png) [@flyhigh72](https://forum.opensearch.org/u/flyhigh72)\
**Post date:** [June 22, 2021, 3:50am UTC](https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302/1 "2021-06-22T03:50:42Z")

</div>

I have been using ELK + OD for almost 2 years. I also used template to map my data into right type. One of the columns is in IP type and it starts getting error after upgrading to OpenSearch. The error is:

[2021-06-22T09:58:28,388][WARN][logstash.outputs.elasticsearch][csv2es][4b0c260d0d4cc87a2e2573c6915e7d31d43c8e67fba73a496b973901f6797306] Could not index event to Elasticsearch. {:status=\>400, :action=\>[“index”, {:\_id=\>nil, :\_index=\>“index20210622”, :\_routing=\>nil, :\_type=\>“doc”}, #LogStash::Event:0x5966a733], :response=\>{“index”=\>{“\_index”=\>“index20210622”, “\_type”=\>“doc”, “\_id”=\>“hsxwMXoBD8uHKzxEr5KM”, “status”=\>400, “error”=\>{“type”=\>“illegal\_argument\_exception”, “reason”=\>“mapper [client\_ip] cannot be changed from type [ip] to [text]”}}}}

My template looks like this:

```
"mappings": {
	"properties": {
		"@timestamp": {
			"type": "date"
		},
		"client_ip": {
			"type": "text"
		}
	}
}

```

Is the type IP not supported in OpenSearch?

Thanks,

---

<div class="post-metadata">

**Author:** ![flyhigh72](https://avatars.discourse-cdn.com/v4/letter/f/a87d85/32.png) [@flyhigh72](https://forum.opensearch.org/u/flyhigh72)\
**Post date:** [June 22, 2021, 8:35am UTC](https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302/2 "2021-06-22T08:35:16Z")

</div>

It seems like the document about index template at [https://docs-beta.opensearch.org/opensearch/index-templates/](https://docs-beta.opensearch.org/opensearch/index-templates/) is inaccurate or incomplete.

For example, using the command below resulted an error:  
GET \_index\_template/daily\_logs

instead, using the one below is correct:  
GET \_template/daily\_logs

I think I need the latest complete document about the template syntax in order to resolve this issue.

Thanks,

---

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [June 22, 2021, 2:18pm UTC](https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302/3 "2021-06-22T14:18:41Z")

</div>

I don’t know of any changes like this.

What version of Open Distro were you using? Also, have you changed your version of Logstash or anything else in your setup?

---

<div class="post-metadata">

**Author:** ![flyhigh72](https://avatars.discourse-cdn.com/v4/letter/f/a87d85/32.png) [@flyhigh72](https://forum.opensearch.org/u/flyhigh72)\
**Post date:** [June 22, 2021, 3:01pm UTC](https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302/4 "2021-06-22T15:01:20Z")

</div>

I’m using OpenSearch 1.0.0-rc1 with Logstash 7.11.1. Before upgrading to OpenSearch I was using OD 1.13.1 with Logstash 7.11.1 with no such an issue, I meant, the template works fine with no error in Logstash log.

---

<div class="post-metadata">

**Author:** ![shdubsh](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shdubsh](https://forum.opensearch.org/u/shdubsh)\
**Post date:** [June 22, 2021, 9:48pm UTC](https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302/5 "2021-06-22T21:48:45Z")

</div>

This sounds similar to: [[BUG] Logstash cannot submit events to OpenSearch since version change · Issue #667 · opensearch-project/OpenSearch · GitHub](https://github.com/opensearch-project/OpenSearch/issues/667)

If the issue is the same, you might try setting `document_type => "_doc"` in the elasticsearch output config as a temporary workaround. A version compatibility flag for opensearch is in the works, but isn’t available yet.

---

<div class="post-metadata">

**Author:** ![flyhigh72](https://avatars.discourse-cdn.com/v4/letter/f/a87d85/32.png) [@flyhigh72](https://forum.opensearch.org/u/flyhigh72)\
**Post date:** [June 22, 2021, 10:14pm UTC](https://forum.opensearch.org/t/indexing-with-an-ip-type-caused-error/6302/6 "2021-06-22T22:14:59Z")

</div>

This suggestion did eliminate the errors, however, it also bypass the template and creates the index with column names of its default data type interpretation. I do need the template to build the columns with data type I need. I’ll wait for next release and hope it will be addressed. Thanks.