# Custom Analyser for IPv4 Mapped IPv6

**URL:** <https://discuss.elastic.co/t/custom-analyser-for-ipv4-mapped-ipv6/290822>\
**Category:** Elasticsearch\
**Created:** [December 2, 2021, 7:55pm UTC](https://discuss.elastic.co/t/custom-analyser-for-ipv4-mapped-ipv6/290822 "2021-12-02T19:55:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sai\_Satwik\_Kuppili](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_satwik_kuppili/32/98048_2.png) [@Sai\_Satwik\_Kuppili](https://discuss.elastic.co/u/Sai_Satwik_Kuppili)\
**Post date:** [December 2, 2021, 7:55pm UTC](https://discuss.elastic.co/t/custom-analyser-for-ipv4-mapped-ipv6/290822/1 "2021-12-02T19:55:07Z")

</div>

Seems Elasticsearch doesn't allow IPv4 mapped IPv6 with CIDR to index. When I was trying to index IPv4-mapped-IPv6

> ::ffff:127.12.0.1/108

I am getting the following error.

```auto
PUT test
PUT test/_mapping/
{
    "dynamic_templates": [
        {
            "ip_range": {
                "match": "*ip_range",
                "mapping": {
                    "type": "ip_range",
                    "ignore_malformed": true
                }
            }
        }
    ]
}
PUT test/_doc/1
{
  "test1_ip_range": "::ffff:127.12.0.1/108"
}

```

```auto
{
    "error": {
        "root_cause": [
            {
                "type": "mapper_parsing_exception",
                "reason": "failed to parse field [test1_ip_range] of type [ip_range] in document with id '2'. Preview of field's value: '::ffff:127.12.0.1/108'"
            }
        ],
        "type": "mapper_parsing_exception",
        "reason": "failed to parse field [test1_ip_range] of type [ip_range] in document with id '2'. Preview of field's value: '::ffff:127.12.0.1/108'",
        "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "CIDR notation is not allowed with IPv6-mapped IPv4 address [::ffff:127.12.0.1 as it introduces ambiguity as to whether the prefix length should be interpreted as a v4 prefix length or a v6 prefix length"
        }
    },
    "status": 400
}

```

But when I index IPv4, and when I query on IPv4 mapped IPv6, Elasticsearch query execution is working as expected.

Ex:

```auto
PUT test/_doc/2
{
  "test1_ip_range": "127.12.0.1/12"
}

GET test/_doc/_search
{
    "query": {
        "term": {
            "test1_ip_range": "::ffff:127.12.0.2"
        }
    }
}

```

In this case, search query returning expected results.  
From the error thrown by the Elasticsearch, it seems IPv4-mapped IPv6 with CIDR cannot get indexed by Elasticsearch.

So I was thinking if we could write an custom analyser which can convert IPv4-mapped IPv6 with CIDR into IPv4 with CIDR before indexing.

Seems any IPv4 mapped IPv6 with CIDR can be converted to IPv4 by just removing prefix ::ffff: and by substracting 96 from CIDR value

Example: IPv4 for ::ffff:127.12.0.1/108 is 127.12.0.1/12.

Could someone help me if we can do this with custom analyser or by making some changes to Elasticsearch template? Any help is appreciated. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2021, 7:55pm UTC](https://discuss.elastic.co/t/custom-analyser-for-ipv4-mapped-ipv6/290822/2 "2021-12-30T19:55:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.