# EQL cidrmatch issue **URL:** \ **Category:** SIEM\ **Tags:** eql-elastic-query-language\ **Created:** [June 3, 2021, 2:02pm UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885 "2021-06-03T14:02:28Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ima/32/99895_2.png) [@ima](https://discuss.elastic.co/u/ima)\ **Post date:** [June 3, 2021, 2:02pm UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885/1 "2021-06-03T14:02:28Z")
hello guys, I created an eql rule for ssh access I wanna match multiple IP ranges but I get this error that the destination.ip field is text and not IP can you please suggest me another way to do that. here's my query { sequence with maxspan=15m [any where cidrmatch(destination.ip, "[10.1.6.0/24](http://10.1.6.0/24)", "[10.1.2.0/24](http://10.1.2.0/24)", "[10.1.20.0/24](http://10.1.20.0/24)", "[10.1.3.0/24](http://10.1.3.0/24)", "[172.44.8.0/24](http://172.44.8.0/24)", "[192.168.24.0/24](http://192.168.24.0/24)", "[10.10.11.0/24](http://10.10.11.0/24)", "[1.10.12.0/24](http://1.10.12.0/24)") and destination.port==22 and event.action=="Allow" ] [any where source.ip not in ("[1.1.41.43](http://1.1.41.43/)" , "[1.1.1.84](http://1.1.1.84/)" , "[1.1.1.55](http://1.1.1.55/)", "[172.44.10.1](http://172.44.10.1/)"," [10.1.15.6](http://10.1.15.6/)")] } and here's the error I get : must be [ip], found value [destination.ip] type [text] ---
**Author:** ![matriv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matriv/32/43656_2.png) [@matriv](https://discuss.elastic.co/u/matriv)\ **Post date:** [June 7, 2021, 10:24am UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885/2 "2021-06-07T10:24:51Z")
The only workaround I see is to have a filtering with `OR` and [`regex`](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html#eql-syntax-pattern-comparison-keywords) to express this `cidrmatch`, and be aware that this would most probably be significantly slower than a cidrmatch on `IP` fields. The best solution is to reindex your data using the correct mapping (data types for your fields). ---
**Author:** ![ima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ima/32/99895_2.png) [@ima](https://discuss.elastic.co/u/ima)\ **Post date:** [June 7, 2021, 10:26am UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885/3 "2021-06-07T10:26:42Z")
yeah I used runtime field and it works now thank you. ---
**Author:** ![matriv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matriv/32/43656_2.png) [@matriv](https://discuss.elastic.co/u/matriv)\ **Post date:** [June 7, 2021, 1:46pm UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885/4 "2021-06-07T13:46:28Z")
Nice, haven't thought of that workaround. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2021, 1:46pm UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885/5 "2021-07-05T13:46:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.