Match partial IP


In my index, I have an IP field. The type of the field is "ip".

I want to search all IPs who starts with "192.168"

All my tentative have failed with the following message: failed to parse ip [192.168], not a valid ip address

Is there a way of doing this or should I change the type of the field to "string"?


My bad, i didn't think of using a range query, so the following will works:

GET my_index/_search
  "query": {
    "range": {
      "ip_addr": {
        "gte": "",
        "lt":  ""
1 Like