Luceny query: 10.* gives incorrect results such as 100.xxx

[Sjaak01 (Sjaak)]

Hi,

I'm trying to filter some IP's but for whatever reason something like source:10.* will also show IP's in the 100.xxx etc. range while it should show only 10.xxx.

Using a similar query for 192.168.* or 172.16.* works without problems and returns only the correct ranges.

Why isn't this working for 10.*?

[Nathan_Reese]

What mapping are you using for the ip field? Is the field mapped as IP type or keyword type?

When mapping as the IP, * did not return any matching results. When mapping as keywork, the query worked as expected

Below is a sample data set. Run the following scripts in Dev tools

PUT test
{}

PUT test/_mapping
{
  "properties": {
    "ip_addr": {
      "type": "keyword"
    }
  }
}

PUT test/_doc/1
{
  "ip_addr": "100.168.1.1"
}

PUT test/_doc/2
{
  "ip_addr": "10.168.1.1"
}

Then the query worked as expected

[Sjaak01 (Sjaak)]

Its mapped as a keyword. However the problem isn't that 10.* doesn't return any results, the problem is that it returns too many results.

10.* should only match 10.* IP's, but instead it also matches IP's such as 100.*.

[Nathan_Reese]

I did not see that in the provided example. Can you show some of the matching results that you think should be shown? Do they have 10. for any of the octets?

[Sjaak01 (Sjaak)]

Had to hide some of the data but there is no 10. anywhere in this example.