Hey,
there are basically two solutions to this: at index time and at query time, if your document contains the list of ip adresses as well as the ip address to check for. Take this example
DELETE test
PUT test/_doc/1
{
"address" : "1.2.3.4",
"addresses" : [ "1.2.3.4", "8.8.8.8", "4.4.4.4" ]
}
PUT test/_doc/2?refresh=true
{
"address" : "4.3.2.1",
"addresses" : [ "1.2.3.4", "8.8.8.8", "4.4.4.4" ]
}
GET test/_search
{
"query": {
"bool": {
"filter": {
"script": {
"script": {
"lang": "painless",
"source": "return doc['addresses.keyword'].value.contains(doc['address.keyword'].value)"
}
}
}
}
}
}
this uses a script filter to check if an IP is with in the list. While this works, it is a bit slower, because you basically have to execute the script for each document.
An alternative is to store this information at index time using an ingest pipeline
DELETE test2
PUT _ingest/pipeline/ip_pipeline
{
"processors": [
{
"script": {
"lang": "painless",
"source": "ctx.contains_ip_address = ctx.addresses.contains(ctx.address)"
}
}
]
}
PUT test2/_doc/1?pipeline=ip_pipeline
{
"address" : "1.2.3.4",
"addresses" : [ "1.2.3.4", "8.8.8.8", "4.4.4.4" ]
}
PUT test2/_doc/2?pipeline=ip_pipeline&refresh=true
{
"address" : "4.3.2.1",
"addresses" : [ "1.2.3.4", "8.8.8.8", "4.4.4.4" ]
}
GET test2/_search
{
"query": {
"bool": {
"filter": {
"term": {
"contains_ip_address": "true"
}
}
}
}
}
the query in this case will be much faster.
hope this helps.