I need to understand how to create in-between query for IP datatype. I need a specific example for IPv6 addresses

Please find some example which might explain. Let me know if helped you # Insert some ipv6 examples into an index PUT my-index-000001 { "mappings": { "properties": { "ip_addr": { "type": "ip" } } } } PUT my-index-000001/_doc/2 { "ip_addr": "2607:f0d0:1002:51::2" …

[image] kelk: my-index-000001/_search Thanks for the response, does this mean, I will have to index all the IPv6 addresses into an index to be able to search using CIDR? if so is there any mechanism that allows for loading all the IPv6 addresses to an index?

Thanks for the response, does this mean, I will have to index all the IPv6 addresses into an index to be able to search using CIDR? no you don't need to. I was just giving an example to simulate the data The only thing you need to be careful is the "mapping" of the field of ip_address. That needs …

I still am not very clear, In the previous example I loaded two IP and then did CIDR search, which brought out all the matches (in this case 2 that I have previously put). What about the IP's I have not added, I would have expected the CIDR range search to give all matching IP's irrespective of them…

[image] shankarlogs: What about the IP's I have not added, I would have expected the CIDR range search to give all matching IP's irrespective of them being in the index. 2607:f0d0::/26 range include 67 ips. Check here CIDR to IPv6 Address Range Utility Tool | IPAddressGuide Kin's Query will …

[image] kelk: GET my-index-000001/_search { "query": { "term": { "ip_addr": "2607:f0d0::/26" } } } I did try the curl curl -XGET 'localhost:9200/my-index-000001/_search?pretty' -H 'Content-Type: application/json' -d' { "query": { "term": { "ip_addr": "2607:f0d0:…

Am I missing something? I am using Elasticsearch 7.7.0. I did try your range query with Ken's IP address, I still did not get the list of IPs in the response

this is what you expected I hope? ie. when you query for a range in cidr notation, you get what you have indexed. If you PUT an IP which is NOT part of the CIDR it shoudn't GET the value

[image] shankarlogs: It would mean that the index will need to have all the IPv6 IPs that matches the CIDR search? Why? Aren't you querying documents who's ip_addr value between IP1 and IP2? If yes, range query will allow you to explicitly specify IP1 and IP2. Cidr in term query will resolv…

In-between Query for IP data type

Elastic Stack Elasticsearch

shankarlogs (Shankar S) July 29, 2020, 3:42pm 10

It would mean that the index will need to have all the IPv6 IPs that matches the CIDR search? If yes, I need to know of a mechanism to get all IPv6 addresses into an index, please let me know if you are aware of any.

Topic		Replies	Views
Indexing CIDR block e.g.: 192.168.1.0/24 Elasticsearch	6	935	May 12, 2018
Searching IP Address Range Using CIDR Mask Elasticsearch	4	4882	July 6, 2017
CIDR query on ip range [2nd try] Elasticsearch	1	636	August 22, 2018
Store an IP range in ES Elasticsearch	6	1274	July 5, 2017
ElasticSearch does not allow IPv6-mapped IPv4 address in field of type ip_range Elasticsearch	1	394	December 29, 2021

In-between Query for IP data type

Related topics