# Convert string to ip in painless processor

**URL:** https://discuss.elastic.co/t/convert-string-to-ip-in-painless-processor/328189
**Category:** Elasticsearch
**Tags:** painless
**Created:** [March 21, 2023, 5:15pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-in-painless-processor/328189 "2023-03-21T17:15:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![HansPeterSloot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanspetersloot/32/51132_2.png) [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [March 21, 2023, 5:15pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-in-painless-processor/328189/1 "2023-03-21T17:15:55Z")

</div>

Hello,

Is there a way to convert a string to an ip address in a painless processor?

Regards Hans

---

<div class="post-metadata">

### Author: ![William\_Brafford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/william_brafford/32/51559_2.png) [@William\_Brafford](https://discuss.elastic.co/u/William_Brafford)
#### Post date: [March 21, 2023, 6:19pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-in-painless-processor/328189/2 "2023-03-21T18:19:58Z")

</div>

If your index has the field [mapped as an IP address](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html), it should be able to accept IP addresses as strings. Here's a quick contrived example from Kibana dev tools:

```auto
# create an index with an IP field mapping
PUT ip-docs
{
  "mappings": {
    "properties": {
      "ip_addr": {
        "type": "ip"
      }
    }
  }
}

# a processor that splits a column-delimited field, assuming an IP address there
PUT _ingest/pipeline/ip_grabber
{
  "processors": [
    {
      "script": {
        "description": "extract IP address",
        "lang": "painless",
        "source": """
            String[] envSplit = ctx['env'].splitOnToken(params['delimiter']);
            ctx['ip_addr'] = envSplit[params['position']].trim();
          """,
        "params": {
          "delimiter": "|",
          "position": 1
        }
      }
    }
  ]
}

# send a document in the expected format
POST ip-docs/_doc?pipeline=ip_grabber
{
  "env": "es01-prod|192.0.0.1"
}

# we can search on the IP
GET ip-docs/_search
{
  "query": {
    "range": {
      "ip_addr": {
        "gte": "192.0.0.0",
        "lte": "192.0.0.2"
      }
    }
  }
}

```

If you want validation and more control over parsing failures, you can use a [convert processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/convert-processor.html) after your script processor:

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "script": {
          "description": "extract IP address",
          "lang": "painless",
          "source": """
            String[] envSplit = ctx['env'].splitOnToken(params['delimiter']);
            ctx['ip_addr'] = envSplit[params['position']].trim();
          """,
          "params": {
            "delimiter": "|",
            "position": 1
          }
        }
      },
      {
        "convert": {
          "field": "ip_addr",
          "type": "ip"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "env": "es01-prod|192.invalid.ip.1"
      }
    }
  ]
}

```

---

<div class="post-metadata">

### Author: ![HansPeterSloot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanspetersloot/32/51132_2.png) [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [March 22, 2023, 9:39am UTC](https://discuss.elastic.co/t/convert-string-to-ip-in-painless-processor/328189/3 "2023-03-22T09:39:15Z")

</div>

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2023, 9:39am UTC](https://discuss.elastic.co/t/convert-string-to-ip-in-painless-processor/328189/4 "2023-04-19T09:39:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
