# How can we search for ranges IP addresses in fields with a query

**URL:** <https://discuss.elastic.co/t/how-can-we-search-for-ranges-ip-addresses-in-fields-with-a-query/22911>\
**Category:** Elasticsearch\
**Created:** [March 26, 2015, 2:55am UTC](https://discuss.elastic.co/t/how-can-we-search-for-ranges-ip-addresses-in-fields-with-a-query/22911 "2015-03-26T02:55:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![charlen1988](https://avatars.discourse-cdn.com/v4/letter/c/258eb7/32.png) [@charlen1988](https://discuss.elastic.co/u/charlen1988)\
**Post date:** [March 26, 2015, 2:55am UTC](https://discuss.elastic.co/t/how-can-we-search-for-ranges-ip-addresses-in-fields-with-a-query/22911/1 "2015-03-26T02:55:19Z")

</div>

"query": {  
"bool": {  
"must": [  
{  
"range": {  
"@timestamp": {  
"from": 1426752000000,  
"to": 1426755600000  
}  
}  
},  
{  
"match": {  
"status": "success"  
}  
}  
],  
"must\_not": [  
{  
"query\_string": {  
"query": "clientip:[10.44.0.0 TO 10.44.255.255]"  
}  
}  
],  
"should": [  
{  
"term": {  
"eventid": "627"  
}  
},  
{  
"term": {  
"eventid": "675"  
}  
}  
],  
"minimum\_should\_match": "1"  
}  
},  
"aggs": {  
"group\_by\_username": {  
"terms": {  
"field": "username",  
"size": 10,  
"min\_doc\_count": 20  
},  
"aggs": {  
"group\_by\_clientip": {  
"terms": {  
"field": "clientip",  
"size": 10  
}  
}  
}  
}  
}

but this can not filter out 10.44.83.54 etc, the result is :  
{  
"key" : "mail",  
"doc\_count" : 20,  
"group\_by\_clientip" : {  
"buckets" : [ {  
"key" : "10.44.85.20",  
"doc\_count" : 5  
}, {  
"key" : "172.22.2.41",  
"doc\_count" : 5  
}, {  
"key" : "10.44.83.54",  
"doc\_count" : 4  
}, {  
"key" : "172.22.2.52",  
"doc\_count" : 2  
}, {  
"key" : "10.23.237.59",  
"doc\_count" : 1  
}, {  
"key" : "10.44.82.25",  
"doc\_count" : 1  
}, {  
"key" : "10.44.82.44",  
"doc\_count" : 1  
}, {  
"key" : "10.44.83.53",  
"doc\_count" : 1  
} ]  
}  
}

how can we filter out these ip by 10.44.0.0/16 ?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/2d89c59a-3614-4192-834c-6f189a2df867%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2d89c59a-3614-4192-834c-6f189a2df867%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:23am UTC](https://discuss.elastic.co/t/how-can-we-search-for-ranges-ip-addresses-in-fields-with-a-query/22911/2 "2017-07-06T00:23:55Z")

</div>