CIDR query on ip range [2nd try]

[vramakrishnan]

This is original question which I posted sometime back and was closed due to no reply or non-activity.

CIDR query on ip_range field not working

I have the following mapping "mappings": { "_doc": { "properties": { "src_ip": { "type": "ip_range", "index": true }, "dst_ip": { "type": "ip_range", "index": true }, "src_port": { "type": "integer_range", "index": true }, "dst_port": { "type": "integer_range", "index": true }, "protocol": { "type" : "keyword" } } } …

Any pointers would help.

With "ip" data type, it does not accept ip address with prefix length(CIDR), but query allows CIDR style.
With "ip_range", it accepts ip address with prefix length(CIDR), but query does not CIDR style.

I need to map ip addresses of the form "10.1.1.1" or "10.1.1.0/16" from a json field to a elastic data type and want to support query in both forms 10.1.1.1 or 10.1.1.0/8 respectively.