Page MenuHomePhabricator

The "logstash-*" index pattern does not contain any of the following field types: ip
Open, LowestPublic

Description

When creating a Kibana visualisation for https://logstash.wikimedia.org/app/kibana#/dashboard/AW5v7YTUarkxubcmAwPB , it's in theory possible to aggregate data via IPv4 Range:

But it shows the error:

No Compatible Fields: The "logstash-*" index pattern does not contain any of the following field types: ip

So I was wondering how/if IPs could be "casted" as type: ip. And how v6 would be handled.

Event Timeline

ayounsi triaged this task as Lowest priority.Nov 20 2019, 9:19 PM
ayounsi created this task.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 20 2019, 9:19 PM

Yes we can, if you know the name of the field we can add an explicit mapping to force the type in modules/profile/files/logstash/elasticsearch-template.json

Looks good! I won't have time to look into this in depth but I'm happy to help if patches need review

fgiunchedi moved this task from Inbox to Backlog on the observability board.Dec 10 2019, 2:01 PM