DSL Query to filter an IP type field to display documents that have a public IP address

Hi there!

I have documents with an IP type field showing 1 or more IP addresses and I need to apply a filter to the documents to show only the documents where there's a public IP address (
non-RFC1918). For example, let's take the below dataset...

doc #1
ip :

doc #2 
ip :,

doc #3

doc #4

My ideal filter/query would need to able to display only doc #3 (private + public address) and doc #4 (public address)

I have tried using the below DSL filter to exclude RFC1918 addresses but that only return doc #4 and I'm missing doc # 3 because it has a private/RFC1918 address ( and public address (

  "query": {
    "bool": {
      "filter": {
        "exists": {
          "field": "ip"
      "must_not": [
          "terms": {
            "ip": [

Any ideas or guidance on how can I solve my problem?



Disregard this post, I solved this on the code (python) side.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.