# PAcketbeat Flow wih CIDR search on Kibana **URL:** \ **Category:** Kibana\ **Created:** [May 6, 2018, 9:12pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760 "2018-05-06T21:12:49Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 6, 2018, 9:12pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/1 "2018-05-06T21:12:49Z")
Hi i have a packetbeat flow index with dest.ip :x.x.x.x which is working fine. What i need to do now is if it is possible to search based on CIDR notation instead of individual ips . Like if i want to find how much byte to and fro a particular CIDR address for a given time . Really appreciate your kind help in advacne ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 7, 2018, 5:29am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/2 "2018-05-07T05:29:14Z")
Specifically for CIDR notation you would use a `term` query. This requires that the field is indexed as the type `ip`. Other options to query for ranges of IP addresses are the `query_string` and `range` queries. Below are examples of each. The field used in the examples is from [ElastiFlow](https://github.com/robcowart/elastiflow) but you should get the idea of how they work: **term** : ```auto { "query": { "term": { "flow.dst_addr": "192.168.12.0/24" } } } ``` **query\_string** : ```auto { "query": { "query_string": { "query": "flow.dst_addr: \"192.168.0.0/24\"" } } } ``` ```auto { "query": { "query_string": { "query": "flow.dst_addr:[192.168.12.1 TO 192.168.12.255]" } } } ``` **range** : ```auto { "query": { "range": { "flow.dst_addr": { "gte": "192.168.12.1", "lte": "192.168.12.255" } } } } ``` Rob Robert Cowart ([rob@koiossian.com](mailto:rob@koiossian.com)) [www.koiossian.com](http://www.koiossian.com) True Turnkey SOLUTIONS for the Elastic Stack ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 7, 2018, 7:42pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/3 "2018-05-07T19:42:12Z")
Hi Rob sorry for the silly question i am aware that this code need to b execute somewhere . Please note i have been use elk stack for quite sometime but i an yet familiar with it throughly. So really i don't understand where this code should be and also is this allow me to do search on the Kibana search field . i hope you understand ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 7, 2018, 8:18pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/4 "2018-05-07T20:18:53Z")
The search bar uses Lucene syntax by default, which is the syntax for a `query_string` query. So put this in the search bar: ```auto dest.ip: "192.168.1.0/24" ``` > NOTE: The quotes around the CIDR subnet are important. It won't work without them. ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 7, 2018, 8:23pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/5 "2018-05-07T20:23:27Z")
> [@rcowart](#): > > dest.ip: "192.168.1.0/24" thanks Rob ... now i can see a result ... but only when i used individual ips not the CIDR notaiotn like dest.ip"8.8.0.0/16" ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 7, 2018, 8:36pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/6 "2018-05-07T20:36:54Z")
You are missing a colon: `dest.ip"8.8.0.0/16"`should be `dest.ip: "8.8.0.0/16"` ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 7, 2018, 9:13pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/7 "2018-05-07T21:13:47Z")
![pack](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d18de19ab9e451cd49537db28dab280e3889f0a9.png) Hi Rob This is what is shown ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 7, 2018, 9:18pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/8 "2018-05-07T21:18:53Z")
this is the success search ![pack](https://us1.discourse-cdn.com/elastic/original/3X/0/7/0727fe0044a3328e1b0807ddd71ff2597f470d8e.png) thanks Rob ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 7, 2018, 9:38pm UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/9 "2018-05-07T21:38:08Z")
However i can do this ... i think the maximum is a /24 dest.ip:[192.168.2.1 TO 192.168.2.255] ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 8, 2018, 5:21am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/10 "2018-05-08T05:21:27Z")
You should look at the index pattern and ensure that `dest.ip` was indexed as an IP and not a string. Here is an example from my system that shows this working: **All data** : ![54](https://us1.discourse-cdn.com/elastic/original/3X/4/2/425dc0df72debd02f99a20240cdbe858b25ade70.png) **10.0.0.0/8** ![27](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b94ad8dac386748898445a423bb2a1e8eeea0a4.png) **192.168.3.0/24** ![37](https://us1.discourse-cdn.com/elastic/original/3X/5/1/51996e3d0fb7908205d58d100e538a9af6df122b.png) Rob Robert Cowart ([rob@koiossian.com](mailto:rob@koiossian.com)) [www.koiossian.com](http://www.koiossian.com) True Turnkey SOLUTIONS for the Elastic Stack ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 8, 2018, 6:40am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/11 "2018-05-08T06:40:56Z")
![pack](https://us1.discourse-cdn.com/elastic/original/3X/7/6/7652036047670bcb2c37f0c0952d470f71669d6d.png) Hi Rob I believe it is index as required as this is what i have similar to your but the only difference is i cannot use the CIDR ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 8, 2018, 7:15am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/12 "2018-05-08T07:15:57Z")
Notice how your you have a `t` next to dest-ip in your screenshot. This indicates that the field is indexed as a string (or text). Look at mine... ![46](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f46b834a2730abb55ff45d95658bee110d10d742.png) The little PC icon indicates it is indexed as an IP address. Go to Management --\> Index Patterns and find the field. It must be an IP, like this... ![02](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8ec916978c86d94e019ead7b7f7746e8af80362b.png) I expect you will see a string. As I mentioned earlier the field MUST be indexed as the type `ip` for CIDR queries to work. The range query only looked like it was working because it was basically treating it with alphabetical sorting. I just took a look at the packetbeat 6.2.4 index template and it does in fact type `dest.ip` as a `keyword`. ```auto "dest": { "properties": { "ip": { "ignore_above": 1024, "type": "keyword" }, ``` I didn't think about this initially. We don't use any beats data in its out-of-the-box form (data model is just too whacky), and when we normalize it to our own schema we handle the data types properly. I recommend that you open as issue for this in the Beats repository on GitHub. ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 8, 2018, 7:45am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/13 "2018-05-08T07:45:26Z")
any suggestion what i should do with this .....actually this is a result from packetbeat ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 8, 2018, 8:02am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/14 "2018-05-08T08:02:30Z")
Like I said... > [@rcowart](#): > > I recommend that you open an issue for this in the Beats repository on GitHub. They need to fix this in Beats. ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 8, 2018, 8:07am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/15 "2018-05-08T08:07:40Z")
thanks what are you using ??? syslog + logstash ??? ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 8, 2018, 8:47am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/16 "2018-05-08T08:47:07Z")
i try to change this but not work either ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 8, 2018, 9:11am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/17 "2018-05-08T09:11:27Z")
Our solutions take in a number of [log](http://www.koiossian.com/log-integrations/) and [network flow](http://www.koiossian.com/network-flow-integrations/) sources, normalize this data to common schemas, and provide a suite of visualizations, dashboards, alerts and anomaly detection methods that work seamless across all data sources. We are primarily focused on [security](http://www.koiossian.com/security-analytics/) and [network flow analytics](http://www.koiossian.com/synesis-network-flow-analytics/). However we have also helped our customers in the other areas, such as performance management, and even IoT/Smart Cities projects. We currently send Packetbeat data to Logstash, where it is transformed to meet the requirements of our customers. In the future this function will likely be moved into Kafka Streams jobs (faster and more scalable). Most of our customers understand the potential of what can be achieved with the Elastic Stack. However they lack the time required to learn all of the little (sometimes undocumented) details needed to build it themselves. We typically deliver in just a couple days, what it would take them months to do on their own. We also contribute to the community with projects for basic [network flow](https://github.com/robcowart/elastiflow) and [syslog](https://github.com/koiossian/synesis_lite_syslog) collection. ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 8, 2018, 9:16am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/18 "2018-05-08T09:16:12Z")
NOTE: if you change the index template, making dest.ip (and other IP addresses) an `ip` type, you will have to wait until a new index is created. Index templates only have effect at index creation. You also need to prevent Packetbeat from overwriting your template, as it will by default. [https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-template.html](https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-template.html) ---
**Author:** ![Tzathenah\_Peaneah\_Ha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tzathenah_peaneah_ha/32/30848_2.png) [@Tzathenah\_Peaneah\_Ha](https://discuss.elastic.co/u/Tzathenah_Peaneah_Ha)\ **Post date:** [May 8, 2018, 10:11am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/19 "2018-05-08T10:11:12Z")
so you suggest i delete the index and recreate ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 5, 2018, 10:11am UTC](https://discuss.elastic.co/t/packetbeat-flow-wih-cidr-search-on-kibana/130760/20 "2018-06-05T10:11:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.