# Elasticsearch ip range query

**URL:** <https://discuss.elastic.co/t/elasticsearch-ip-range-query/166106>\
**Category:** Elasticsearch\
**Created:** [January 29, 2019, 7:44am UTC](https://discuss.elastic.co/t/elasticsearch-ip-range-query/166106 "2019-01-29T07:44:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vnpt\_Pham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vnpt_pham/32/40320_2.png) [@vnpt\_Pham](https://discuss.elastic.co/u/vnpt_Pham)\
**Post date:** [January 29, 2019, 7:44am UTC](https://discuss.elastic.co/t/elasticsearch-ip-range-query/166106/1 "2019-01-29T07:44:41Z")

</div>

Dear,

I set mapping below

```
PUT iptest
{
   "mappings": {
      "addy": {
          "properties":{
             "ips": { "type": "ip"}
          }
      }
   }
}

```

And insert data:

```
PUT iptest/addy/1?refresh
{"ips": ["10.230.208.88", "0.0.0.0"]}

PUT iptest/addy/2?refresh
{"ips": ["10.0.2.15","192.168.56.106"]}

```

Then query (1):

```
GET iptest/_search
{
	"query": {
		"bool": {
			"filter": [{
				"bool": {
					"must": [{
						"range": {
							"ips": {
								"gte": "10.52.51.14"
							}
						}
					},
					{
						"range": {
							"ips": {
								"lte": "10.52.51.34"
							}
						}
					}]
				}
			}]
		}
	},
	"from": 0,
	"size": 100,
	"_source": ["ips"]
}

```

But results is:

```
"hits" : [
      {
        "_index" : "iptest",
        "_type" : "addy",
        "_id" : "2",
        "_score" : 0.0,
        "_source" : {
          "ips" : [
            "10.0.2.15",
            "192.168.56.106"
          ]
        }
      },
      {
        "_index" : "iptest",
        "_type" : "addy",
        "_id" : "1",
        "_score" : 0.0,
        "_source" : {
          "ips" : [
            "10.230.208.88",
            "0.0.0.0"
          ]
        }
      }
    ]

```

I see "10.0.2.15" \<= "10.52.51.34" AND "192.168.56.106" \>= "10.52.51.14" ==\> matching.  
I want a element of ips is matching for this condition: "10.0.2.15" \<= ip \<= "10.52.51.34".

Thanks so much.

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [January 29, 2019, 2:27pm UTC](https://discuss.elastic.co/t/elasticsearch-ip-range-query/166106/2 "2019-01-29T14:27:28Z")

</div>

Your current query searches for a document where **any** IP matches the first clause and **any** IP matches the second clause. Both clauses or not necessarily applied to the same IP. What you want to do instead is rewrite your query to something like this:

```auto
GET iptest/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "ips": {
              "gte": "10.52.51.14",
              "lte": "10.52.51.34"
            }
          }
        }
      ]
    }
  },
  "from": 0,
  "size": 100,
  "_source": [
    "ips"
  ]
}

```

That way, the range is applied to one specific IP.

---

<div class="post-metadata">

**Author:** ![vnpt\_Pham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vnpt_pham/32/40320_2.png) [@vnpt\_Pham](https://discuss.elastic.co/u/vnpt_Pham)\
**Post date:** [February 1, 2019, 2:49am UTC](https://discuss.elastic.co/t/elasticsearch-ip-range-query/166106/3 "2019-02-01T02:49:35Z")

</div>

Thanks abdon.  
I tried successfully.

Is there another way to use mapping?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2019, 3:00am UTC](https://discuss.elastic.co/t/elasticsearch-ip-range-query/166106/4 "2019-03-01T03:00:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.