Queries on "ip_range" type (missing documentation)

Elastic Stack Elasticsearch
5

Matching the exact range is a bit more involved as range fields aren't meant for this sort of query.

One strategy would be to change your mapping and add a keyword multi-field that holds the original network address and mask. You can then do an exact match against that using a match query.

For example:

PUT testiprangefield
{
  "settings": {
    "number_of_replicas": 0
  },
  "mappings": {
    "properties": {
      "iprangefield": {
        "type": "ip_range",
        "fields": {
          "raw": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

You can add documents in the usual way:

PUT testiprangefield/_doc/1
{
  "iprangefield": "192.168.1.1/28"
}

Then search against the raw multi-field.

GET testiprangefield/_search
{
  "query": {
    "match": {
      "iprangefield.raw": "192.168.1.1/28"
    }
  }
}
1 Like