# Is "ip\_range" a real bucket aggregation?

**URL:** <https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446>\
**Category:** Elasticsearch\
**Created:** [February 14, 2020, 9:00pm UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446 "2020-02-14T21:00:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [February 14, 2020, 9:00pm UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446/1 "2020-02-14T21:00:13Z")

</div>

I'm getting a weird error when running the following `ip_range` aggs with a `buckets_path`:

```auto
GET ecs-net-7*/_search
{
  "size": 0,
  "aggs": {
    "1-bucket": {
      "ip_range": {
        "field": "destination.ip",
        "ranges": [
          {
            "mask": "192.168.0.0/16"
          },
          {
            "mask": "10.10.0.0/16"
          }
        ],
        "keyed": false
      }, 
      "aggs": {
        "1-metric": {
          "sum": {
            "field": "source.bytes"
          }
        }
      }
    },
    "1": {
      "sum_bucket": {
        "buckets_path": "1-bucket>1-metric"
      }
    }
  }
}

```

ERROR

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "The first aggregation in buckets_path must be a multi-bucket aggregation for aggregation [1] found :org.elasticsearch.search.aggregations.bucket.range.IpRangeAggregationBuilder for buckets path: 1-bucket>1-metric"
      }

```

`ip_range` _is_ a multi-bucket aggregation, isn't it?

The `filters` aggregation with the following values, works just fine:

```auto
        "filters": [
          {
            "match": {
              "destination.ip": "192.168.0.0/16"
            }
          },
          {
            "match": {
              "destination.ip": "10.10.0.0/16"
            }
          }
        ]

```

So, the question: why the `filters` agg does produce "good" buckets, and the `ip_range` agg does not?  
Thanks!

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [February 17, 2020, 9:02am UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446/2 "2020-02-17T09:02:28Z")

</div>

does make sense to open a Github ticket?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 17, 2020, 9:18am UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446/3 "2020-02-17T09:18:30Z")

</div>

I don't know. What do you think @jimczi @jpountz?

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [February 17, 2020, 10:00pm UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446/4 "2020-02-17T22:00:29Z")

</div>

Yes this looks like a bug, please open a Github ticket.

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [March 6, 2020, 8:32am UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446/5 "2020-03-06T08:32:12Z")

</div>

submitted a [ticket](https://github.com/elastic/elasticsearch/issues/53215)

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [March 25, 2020, 10:38am UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446/6 "2020-03-25T10:38:16Z")

</div>

I've opened [https://github.com/elastic/elasticsearch/pull/54161](https://github.com/elastic/elasticsearch/pull/54161) to fix this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 22, 2020, 10:38am UTC](https://discuss.elastic.co/t/is-ip-range-a-real-bucket-aggregation/219446/7 "2020-04-22T10:38:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.