# How to drop mutiple IPs efficiently in using grok filter
**URL:** https://discuss.elastic.co/t/how-to-drop-mutiple-ips-efficiently-in-using-grok-filter/186107
**Category:** Logstash
**Created:** [June 17, 2019, 3:27pm UTC](https://discuss.elastic.co/t/how-to-drop-mutiple-ips-efficiently-in-using-grok-filter/186107 "2019-06-17T15:27:14Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Chang-Suk\_Kang](https://discuss.elastic.co/u/Chang-Suk_Kang)
#### Post date: [June 17, 2019, 3:27pm UTC](https://discuss.elastic.co/t/how-to-drop-mutiple-ips-efficiently-in-using-grok-filter/186107/1 "2019-06-17T15:27:14Z")
I'd like to drop multiple ips in messaging.
I wrote config below. .
Sample : I waana drop message including ip (10.10.10.31 ~ 10.10.10.49)
===========================================================================
if [Src\_IP] == "10.10.10.31" or [Src\_IP] == "10.10.10.32" or [Src\_IP] == "10.10.10.33" or [Src\_IP] == "10.10.10.34" or ~~~~ or [Src\_IP] == "10.10.10.49" { drop {} }
How do I check this config more efficiently??
Any Ideas?? Plz..
Thanks in advance. ^^;
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 17, 2019, 4:39pm UTC](https://discuss.elastic.co/t/how-to-drop-mutiple-ips-efficiently-in-using-grok-filter/186107/2 "2019-06-17T16:39:09Z")
Match the IP against a set of CIDR ranges that comprise the complete range you want to drop, then drop if the tag is present. For your example that would be
```
address => "%{ip}"
network => ["10.10.10.31/32", "10.10.10.47/28", "10.10.10.48/31"]
add_tag => ["matched"]
```
---
### Author:  [@Chang-Suk\_Kang](https://discuss.elastic.co/u/Chang-Suk_Kang)
#### Post date: [June 18, 2019, 1:19am UTC](https://discuss.elastic.co/t/how-to-drop-mutiple-ips-efficiently-in-using-grok-filter/186107/3 "2019-06-18T01:19:43Z")
Thanks, I try to... right now~ ^^;
---
### Author:  [@Chang-Suk\_Kang](https://discuss.elastic.co/u/Chang-Suk_Kang)
#### Post date: [June 20, 2019, 7:08am UTC](https://discuss.elastic.co/t/how-to-drop-mutiple-ips-efficiently-in-using-grok-filter/186107/4 "2019-06-20T07:08:34Z")
It works Great!! Thanks a lot~ ^^;
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2019, 7:08am UTC](https://discuss.elastic.co/t/how-to-drop-mutiple-ips-efficiently-in-using-grok-filter/186107/5 "2019-07-18T07:08:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.