How do you search for many IP addresses and output only the source IP and destination IP in Dev Tools [Kibana]

Elastic Stack Kibana
1

So the query to search for a single IP is:

GET _search
{
  "query": {
    "term": {
      "ip_addr": "43.225.52.0/23"
      
    }
  }
}

But this is only able to search for one IP address
My original query was:

GET _search 

{ 
   "query": { 
      "terms": { 
  	   "DestinationIP": [ 
    	      "100.42.74.212", 
    	      "101.50.1.23", 
    	      "101.99.90.41", 
    	      "103.114.160.253" 
  	      ] 
} 
   } 
}

But this outputted everything when I was only interested in the associated source address and associated destination IP address. If any returned at all

How do I query for many IP addresses and output only the source IP and destination IP?

2

Does the fields option cover your case? Retrieve selected fields from a search | Elasticsearch Guide [8.11] | Elastic

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.