# In-between Query for IP data type **URL:** \ **Category:** Elasticsearch\ **Created:** [July 28, 2020, 10:26am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882 "2020-07-28T10:26:01Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 28, 2020, 10:26am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/1 "2020-07-28T10:26:02Z")
I need to understand how to create in-between query for IP datatype. I need a specific example for IPv6 addresses ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 28, 2020, 3:17pm UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/2 "2020-07-28T15:17:44Z")
Please find some example which might explain. Let me know if helped you ```auto # Insert some ipv6 examples into an index PUT my-index-000001 { "mappings": { "properties": { "ip_addr": { "type": "ip" } } } } PUT my-index-000001/_doc/2 { "ip_addr": "2607:f0d0:1002:51::2" } PUT my-index-000001/_doc/3 { "ip_addr": "2607:f0d0:1002:0051:0000:0000:0000:0003" } ``` Now search using IPv6 CIDR notation ```auto GET my-index-000001/_search { "query": { "term": { "ip_addr": "2607:f0d0::/26" } } } ``` ---
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 29, 2020, 6:12am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/3 "2020-07-29T06:12:51Z")
> [@kelk](#): > > `my-index-000001/_search` Thanks for the response, does this mean, I will have to index all the IPv6 addresses into an index to be able to search using CIDR? if so is there any mechanism that allows for loading all the IPv6 addresses to an index? ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 29, 2020, 7:13am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/4 "2020-07-29T07:13:39Z")
```auto Thanks for the response, does this mean, I will have to index all the IPv6 addresses into an index to be able to search using CIDR? ``` no you don't need to. I was just giving an example to simulate the data The only thing you need to be careful is the `"mapping"` of the field of ip\_address. That needs to be type of type `"ip"` So the index which you have loaded , try to change the mapping of the field where the ip\_addr resides to `ip` and then you have full flexiblity ---
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 29, 2020, 7:52am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/5 "2020-07-29T07:52:28Z")
I still am not very clear, In the previous example I loaded two IP and then did CIDR search, which brought out all the matches (in this case 2 that I have previously put). What about the IP's I have not added, I would have expected the CIDR range search to give all matching IP's irrespective of them being in the index. In my usecase I will have startIP and endIP only, I will need to figure out if the input IP is between the startIP and endIP, can you please put up an example and explain? ---
**Author:** ![Vinayak\_Sapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinayak_sapre/32/45939_2.png) [@Vinayak\_Sapre](https://discuss.elastic.co/u/Vinayak_Sapre)\ **Post date:** [July 29, 2020, 10:42am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/6 "2020-07-29T10:42:25Z")
> [@shankarlogs](#): > > What about the IP's I have not added, I would have expected the CIDR range search to give all matching IP's irrespective of them being in the index. 2607:f0d0::/26 range include 67 ips. Check here [CIDR to IPv6 Address Range Utility Tool | IPAddressGuide](https://www.ipaddressguide.com/ipv6-cidr) Kin's Query will match all documents where ip\_addr is in one of these 67 ips. Alternatively you can use range query ```auto { "query": { "range": { "ip_addr": { "gte": "2001:0000:3238:DFE1:64::FEFB", "lt": "2001:0000:3238:DFE1:66::FEFC" } } } } ``` ---
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 29, 2020, 2:11pm UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/7 "2020-07-29T14:11:10Z")
> [@kelk](#): > > ```auto > GET my-index-000001/_search > { > "query": { > "term": { > "ip_addr": "2607:f0d0::/26" > } > } > } > > ``` I did try the curl ````auto curl -XGET 'localhost:9200/my-index-000001/_search?pretty' -H 'Content-Type: application/json' -d' { "query": { "term": { "ip_addr": "2607:f0d0::/26" } } } ' and got response as ```{ "took" : 1, "timed_out" : false, "_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 2, "relation" : "eq" }, "max_score" : 1.0, "hits" : [ { "_index" : "my-index-000001", "_type" : "_doc", "_id" : "2", "_score" : 1.0, "_source" : { "ip_addr" : "2607:f0d0:1002:51::2" } }, { "_index" : "my-index-000001", "_type" : "_doc", "_id" : "3", "_score" : 1.0, "_source" : { "ip_addr" : "2607:f0d0:1002:0051:0000:0000:0000:0003" } } ] } }``` ```` ---
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 29, 2020, 2:18pm UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/8 "2020-07-29T14:18:34Z")
Am I missing something? I am using Elasticsearch 7.7.0. I did try your range query with Ken's IP address, I still did not get the list of IPs in the response ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 29, 2020, 2:44pm UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/9 "2020-07-29T14:44:59Z")
this is what you expected I hope? ie. when you query for a range in cidr notation, you get what you have indexed. If you PUT an IP which is NOT part of the CIDR it shoudn't GET the value ---
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 29, 2020, 3:42pm UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/10 "2020-07-29T15:42:51Z")
It would mean that the index will need to have all the IPv6 IPs that matches the CIDR search? If yes, I need to know of a mechanism to get all IPv6 addresses into an index, please let me know if you are aware of any. ---
**Author:** ![Vinayak\_Sapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinayak_sapre/32/45939_2.png) [@Vinayak\_Sapre](https://discuss.elastic.co/u/Vinayak_Sapre)\ **Post date:** [July 30, 2020, 6:23am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/11 "2020-07-30T06:23:32Z")
> [@shankarlogs](#): > > It would mean that the index will need to have all the IPv6 IPs that matches the CIDR search? Why? Aren't you querying documents who's ip\_addr value between IP1 and IP2? If yes, range query will allow you to explicitly specify IP1 and IP2. Cidr in term query will resolve to IP1 and IP2. For ex. for `2607:f0d0::/26` IP1 will be `2607:F0D0:0000:0000:0000:0000:0000:0000)` and IP2 will be `2607:F0FF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF` ---
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 30, 2020, 9:04am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/12 "2020-07-30T09:04:27Z")
Like I said before, my use case is to find out if `2607:F0D0:0000:0000:0000:0000:0000:0023` is in between, `2607:F0D0:0000:0000:0000:0000:0000:0000`and `2607:F0FF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF` using in between query. I need to do this process for any IPv6 IPs that are currently in use. So for this to work, I will first need to create an index of such IPs and then use the CIDR in term to get the list of all the IPs that match. Is my understanding correct? ---
**Author:** ![shankarlogs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarlogs/32/72907_2.png) [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Post date:** [July 30, 2020, 9:19am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/13 "2020-07-30T09:19:14Z")
I am tying to figure out if I can use `"ip"` datatype to get to figure the out the all the IP's within a CIDR range, without the index not having each explicit IP ex: I want to find out if `2804:7f0:a081:3f91:a0d4:2294:a75b:2945` is between `2804:07f0:a081:3f91:0000:0000:0000:0000` and `2804:07f0:a081:3f91:ffff:ffff:ffff:ffff` and list all other matching IPs as well ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 27, 2020, 9:19am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882/14 "2020-08-27T09:19:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.