Inconsistent results using Lucene Query Syntax

I am using elasticstack for log analysis. When I am querying from Kibana using the Lucene Query Syntax I am gettting some inconsistent results.

The queries along with their respective number of hits are:

clientIP: [66.249.64.* TO 66.249.79.] --> 18,853 hits
clientIP: [66.249.80.
TO 66.249.93.*] --> 39,630 hits

clientIP: [66.249.64.* TO 66.249.93.*] --> 92,045 hits

Am I doing anything wrong here?

What do you get if you try clientIP: [ TO], clientIP: [ TO] and clientIP: [ TO]?

1 Like

The results seem to have changed but again the sum doesn't add up




What is the mapping of the field?

The mapping I used is string

OK. That means that the IP format will not be enforced. What results do clientIP: [ TO] and clientIP: [ TO] give?

1 Like

This happened



So does changing the mapping for this field fix this? If yes can you plase suggest how to? (becuase the data is already indexed or is it better to reindex the data?)

As you are performing a range query you need to have the same start and end point when you split the interval up as the end value is not included (range is[start <= value < end]). clientIP: [ TO] and clientIP: [ TO] would therefore cover the full range.

If you want to instead map the field as ip you will need to reindex the data into a new index with the correct mapping.

1 Like

Thank you very much @Christian_Dahlqvist

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.