# How do you exclude subnets from search results in Kibana? **URL:** \ **Category:** Elastic Search\ **Created:** [November 19, 2024, 5:16pm UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781 "2024-11-19T17:16:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![meatwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meatwad/32/36031_2.png) [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Post date:** [November 19, 2024, 5:16pm UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781/1 "2024-11-19T17:16:44Z")
Hi there, The Google search results I've found seem old and no longer applicable but I was wondering how you can exclude (or include) subnets from search results in Kibana. I've tried using `NOT source.ip:10.0.0.0/8` for example but I can't seem to find the right syntax. Any help would be greatly appreciated. Thanks! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 19, 2024, 5:21pm UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781/2 "2024-11-19T17:21:41Z")
> [@meatwad](#): > > I've tried using `NOT source.ip:10.0.0.0/8` for example but I can't seem to find the right syntax. This is the correct syntax. what error did you get? Is the `source.ip` field mapped as an IP? ---
**Author:** ![meatwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meatwad/32/36031_2.png) [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Post date:** [November 19, 2024, 6:27pm UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781/3 "2024-11-19T18:27:38Z")
Yes sir: ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/94d1e90701cea4121abdddee4aad68a513c1264d.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/42f9f983fd69bb8506a87095a9baf805a10a5647.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 19, 2024, 6:40pm UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781/4 "2024-11-19T18:40:54Z")
These are the values, not the mapping. Can you check the mapping of the field? `GET index_name/_mapping` What you have when you click in view details? Also, are you using LUCENE or KQL in discover? And which version are you running? ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [November 20, 2024, 12:22am UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781/5 "2024-11-20T00:22:54Z")
As @leandrojmp indicated, `NOT source.ip:10.0.0.0/8` should work if you're using KQL and the source.ip is of type IP in the index mappings. If it's not of type IP, if it's a string, then you can either change the mapping or, if you have access to ES|QL, you can cast the string to an IP address as part of your ES|QL query: ```auto FROM logs-network_traffic.* | eval source.ip = to_ip(source.ip) | WHERE CIDR_MATCH(source.ip, "192.168.0.0/16") ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 18, 2024, 12:23am UTC](https://discuss.elastic.co/t/how-do-you-exclude-subnets-from-search-results-in-kibana/370781/6 "2024-12-18T00:23:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.