# IP address component search
**URL:** https://discuss.elastic.co/t/ip-address-component-search/344132
**Category:** Elasticsearch
**Created:** [September 29, 2023, 11:34am UTC](https://discuss.elastic.co/t/ip-address-component-search/344132 "2023-09-29T11:34:40Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@cesar.hernandez.a3se](https://discuss.elastic.co/u/cesar.hernandez.a3se)
#### Post date: [September 29, 2023, 11:34am UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/1 "2023-09-29T11:34:40Z")
Hi there.
I have a elasticsearch index with a ip address field in the mapping:
```
"address" : {
"type" : "ip"
},
```
I need to know if I can search for any ip byte component, for example, having a document with ip "172.13.200.1", I make a query searching for byte '200', I need to get all documents with:
200._._.\*
_.200._.\*
_._.200.\*
_._.\*.200
Is that possible?
Thanks
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [September 30, 2023, 1:28pm UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/2 "2023-09-30T13:28:16Z")
I'm wondering if you can do that using a bool query with 4 should clauses using ip masks like:
```auto
"term": {
"address": "192.168.0.0/16"
}
```
I have no idea if this would work 😉 .
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 30, 2023, 1:32pm UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/3 "2023-09-30T13:32:00Z")
> [@cesar.hernandez.a3se](#):
>
> Is that possible?
It is not, you can't query for individual octets, but you can make cidr queries as the example in the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html#query-ip-fields).
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [September 30, 2023, 2:03pm UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/4 "2023-09-30T14:03:10Z")
I guess the only way then is to index also the ip address a text field with the default analyzer, that should work out of the box.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 30, 2023, 2:11pm UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/5 "2023-09-30T14:11:07Z")
> [@dadoonet](#):
>
> I guess the only way then is to index also the ip address a text field with the default analyzer, that should work out of the box.
I had this requirement in a past job, the solution I used was to index each octet as different fields and store them as keywords.
Not sure if indexing as a text field would achieve the same result beause the position is relevant.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 1, 2023, 6:32am UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/6 "2023-10-01T06:32:36Z")
For the use case mentioned at the start, the position is not relevant. That's why I suggested this approach.
Otherwise, in addition to @leandrojmp solution, it's possible to index it as a keyword and run a "slow" regex. But I definitely prefer splitting in 4 fields. Much faster at search time! 😊
---
### Author:  [@cesar.hernandez.a3se](https://discuss.elastic.co/u/cesar.hernandez.a3se)
#### Post date: [October 2, 2023, 6:05am UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/7 "2023-10-02T06:05:55Z")
Thank you to both of you.
Yes, I already thought on indexing the field also as text, but I could do it just only with the ip field type.
Cheers
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 30, 2023, 6:06am UTC](https://discuss.elastic.co/t/ip-address-component-search/344132/8 "2023-10-30T06:06:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.