# How to create a filter that contains multiple CIDR ranges?

**URL:** <https://discuss.elastic.co/t/how-to-create-a-filter-that-contains-multiple-cidr-ranges/187457>\
**Category:** Kibana\
**Created:** [June 26, 2019, 2:33am UTC](https://discuss.elastic.co/t/how-to-create-a-filter-that-contains-multiple-cidr-ranges/187457 "2019-06-26T02:33:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![IraB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irab/32/48782_2.png) [@IraB](https://discuss.elastic.co/u/IraB)\
**Post date:** [June 26, 2019, 2:33am UTC](https://discuss.elastic.co/t/how-to-create-a-filter-that-contains-multiple-cidr-ranges/187457/1 "2019-06-26T02:33:35Z")

</div>

Hi there,

I'm using Kibana 6.7 and trying to create some filters that are a set of IP ranges e.g. all AWS IP ranges for a given regions. This of course is a huge list of ip ranges like below:

...  
52.64.0.0-52.64.127.255  
54.153.128.0-54.153.255.255  
3.24.0.0-3.27.255.255  
52.62.0.0-52.63.255.255  
54.253.0.0-54.253.255.255  
52.94.248.64-52.94.248.79  
...

The UI 'Add a filter' option only allows me to add a single IP range, is it possible do it with multiple ranges?

I'd like to be able to programmatically create and update the filter with curl

---

<div class="post-metadata">

**Author:** ![christophilus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christophilus/32/42991_2.png) [@christophilus](https://discuss.elastic.co/u/christophilus)\
**Post date:** [July 2, 2019, 6:48pm UTC](https://discuss.elastic.co/t/how-to-create-a-filter-that-contains-multiple-cidr-ranges/187457/2 "2019-07-02T18:48:40Z")

</div>

You can click "Edit as Query DSL" in the filter editor, and then you can type / paste raw JSON in there.

There may be an easier way, but what I'd do is convert your ranges there to something like this:

```auto
{
  "bool": {
    "should": [
      {
        "range": {
          "clientip": {
            "gte": "52.64.0.0",
            "lte": "52.64.127.255"
          }
        }
      },
      {
        "range": {
          "clientip": {
            "gte": "54.153.128.0",
            "lte": "54.153.255.255"
          }
        }
      }
    ]
  }
}

```

Best of luck!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2019, 6:48pm UTC](https://discuss.elastic.co/t/how-to-create-a-filter-that-contains-multiple-cidr-ranges/187457/3 "2019-07-30T18:48:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.