Histogram aggregation on ip addresses

Elastic Stack Elasticsearch
2

Scripts on ip addresses should work since ES 5.2.0, see

and the example:

https://github.com/elastic/elasticsearch/blob/master/modules/lang-painless/src/test/resources/rest-api-spec/test/painless/50_script_doc_values.yaml

Alternatively you could also categorize the IP address at index time and then use a simple keyword field to store the class c information, and then use a term aggregation on that field to do the count.