Kibana multiple query is not allowed

[111316 (RAY)]

Hello!

To use multiple queries as below, an error occurs.
Please tell me how to use 2 IP bands.

{
"query": {
"bool": {
"should": [
{
"match_phrase": {
"flow.dst_addr": {"gte": "1.1.1.1", "lt": "1.1.1.254"}}
},
{
"match_phrase": {
"flow.dst_addr": {"gte": "2.2.2.1", "lt": "2.2.2.254"}
}
}
],
"minimum_should_match": 1
}
}
}

※ Error in visualization

[esaggs] > Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"parsing_exception","reason":"[match_phrase] query does not support [gte]","line":1,"col":1475}],"type":"parsing_exception","reason":"[match_phrase] query does not support [gte]","line":1,"col":1475},"status":400}

[lukas (Lukas Olson)]

You can use a KQL expression similar to this:

(flow.dst_addr >= 1.1.1.1 and flow.dst_addr < 1.1.1.254) or (flow.dst_addr >= 2.2.2.1 and flow.dst_addr < 2.2.2.254)

[Luca_Belluccini]

@lukas is right.

In DSL, you might want to use:

GET myindex/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "range": {
            "flow.dst_addr": {
              "gte": "1.1.1.1",
              "lt": "1.1.1.254"
            }
          }
        },
        {
          "range": {
            "flow.dst_addr": {
              "gte": "2.2.2.1",
              "lt": "2.2.2.254"
            }
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

Or:

GET myindex/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "term": {
            "flow.dst_addr": "1.1.1.1/24"
          }
        },
        {
          "term": {
            "flow.dst_addr": "2.2.2.1/24"
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}