# How to do lookup based on Ip ranges

**URL:** https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397
**Category:** Logstash
**Created:** [June 9, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397 "2021-06-09T08:16:55Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![tahseen\_fatima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tahseen_fatima/32/67789_2.png) [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [June 9, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397/1 "2021-06-09T08:16:55Z")

</div>

Hi Team,

I have requirement where I have to do lookup on ranges like,  
If Ip  
10.10.x.xx to 10.10x.xxx matches then add fileds Firewall  
10.12.xx.xx to 10.12.x.xxx matches then add fileds Application.

Below is my logstash lookupcode without ranges.

```auto
elasticsearch {
hosts => ["http://localhost:9200"]
index => ["iplist"]
query_template => "C:/Users/xyz/Desktop/elk/ip.json"      
fields => { "Application_name" => "Application_name" }
}

```

```auto
{ 
 "size": 1,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "IP": "%{[Source_Network_Address]}"
          }
        }
      ]
    }
  }
}

```

Kindly help,

Regards,  
Tahseen

---

<div class="post-metadata">

### Author: ![tahseen\_fatima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tahseen_fatima/32/67789_2.png) [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [June 11, 2021, 5:38am UTC](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397/2 "2021-06-11T05:38:00Z")

</div>

Hi,

I have got a solution by my self using the cidr filter plugin in logstash.

[Cidr Filter Plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-cidr.html)

Regards,  
Tahseen

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2021, 5:38am UTC](https://discuss.elastic.co/t/how-to-do-lookup-based-on-ip-ranges/275397/3 "2021-07-09T05:38:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.