# Query a specific IP address in Elastic

**URL:** <https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318>\
**Category:** Elasticsearch\
**Created:** [March 22, 2022, 10:38am UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318 "2022-03-22T10:38:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ianrobo](https://avatars.discourse-cdn.com/v4/letter/i/b19c9b/32.png) [@ianrobo](https://discuss.elastic.co/u/ianrobo)\
**Post date:** [March 22, 2022, 10:38am UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318/1 "2022-03-22T10:38:29Z")

</div>

Hi there,

I am relatively new to elastic and expanding our ES daily.

We are ingesting logs from various network devices but come across a problem in Cisco. They do not send the hostname in their syslog and therefore all we get is for example

log.source.address: 10.1.1.1:56783 (where the port is random)

Therefore in KQL there are many entries for one device and seems no way to simply wildcard 10.1.1.1.

Using Lucene we need to build a regular expression for this and tried various formats but as ^ is not supported there seems no way to say

log.source.address:10/.1/.1/.1:\<1-99999\> and produce a result from this or using various combinations.

Can anyone advise the best code for this ?

Thanks in advance for the advice.

Cheers,  
Ian

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 22, 2022, 12:19pm UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318/2 "2022-03-22T12:19:18Z")

</div>

Instead of trying to figure out how to write a full text search query a more efficient way of solving this would be to store the ip address in a dedicated field of the type [IP](https://www.elastic.co/guide/en/elasticsearch/reference/8.1/ip.html) and query that field...

does that make sense to you?

---

<div class="post-metadata">

**Author:** ![ianrobo](https://avatars.discourse-cdn.com/v4/letter/i/b19c9b/32.png) [@ianrobo](https://discuss.elastic.co/u/ianrobo)\
**Post date:** [March 22, 2022, 12:34pm UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318/3 "2022-03-22T12:34:26Z")

</div>

if that is possible Alexander, certainly, so I was trying to search for a way to convert the output of log.source.address: 10.1.1.1:56783 to say logsource.ip:10.1.1.1 online but could not find it, could you direct me to the resource for that.

Cheers,  
Ian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2022, 12:34pm UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318/4 "2022-04-19T12:34:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.