Match partial IP

Elastic Stack Elasticsearch
1

Hi,

In my index, I have an IP field. The type of the field is "ip".

I want to search all IPs who starts with "192.168"

All my tentative have failed with the following message: failed to parse ip [192.168], not a valid ip address

Is there a way of doing this or should I change the type of the field to "string"?

Thanks.

2

My bad, i didn't think of using a range query, so the following will works:

GET my_index/_search
{
  "query": {
    "range": {
      "ip_addr": {
        "gte": "192.168.0.0",
        "lt":  "192.168.255.255"
      }
    }
  }
}
2 Likes