# Exclude internal ip's **URL:** \ **Category:** Kibana\ **Created:** [February 17, 2016, 7:43pm UTC](https://discuss.elastic.co/t/exclude-internal-ips/42066 "2016-02-17T19:43:02Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Bradly](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@Bradly](https://discuss.elastic.co/u/Bradly)\ **Post date:** [February 17, 2016, 7:43pm UTC](https://discuss.elastic.co/t/exclude-internal-ips/42066/1 "2016-02-17T19:43:02Z")
I am still new and working to figure out how to use elasticsearch correctly to do what I want. I have been able to write some query's to get some information about all of the traffic on our network but now I would like to filter out anything that is internal and only show internet traffic. Currently I am setup as follows ASA firewall -\> ELK (via Netflow) What is the proper way to exclude 10.0.0.0/4, 172.16.0.0/12 and 192.168.0.0/16 from the rest of the traffic. Im sure its simple and I am just going about it all wrong. Brad ---
**Author:** ![stormpython](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stormpython/32/7190_2.png) [@stormpython](https://discuss.elastic.co/u/stormpython)\ **Post date:** [February 17, 2016, 8:15pm UTC](https://discuss.elastic.co/t/exclude-internal-ips/42066/2 "2016-02-17T20:15:21Z")
Hi Brad, You can exclude those patterns from your query using the searchbox and [lucene query syntax](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html). Here is a nice [tutorial](http://www.lucenetutorial.com/lucene-query-syntax.html) site for learning the lucene query syntax. ```auto -ip: "10.0.0.0/4" AND -ip: "172.16.0.0/12" AND -ip: "192.168.0.0/16" ``` where ip is the field name. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:01pm UTC](https://discuss.elastic.co/t/exclude-internal-ips/42066/3 "2017-07-06T14:01:58Z")