# Query for IP External IP Addresses Only **URL:** \ **Category:** Kibana\ **Created:** [March 8, 2022, 1:29am UTC](https://discuss.elastic.co/t/query-for-ip-external-ip-addresses-only/299024 "2022-03-08T01:29:32Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Wilks](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Post date:** [March 8, 2022, 1:29am UTC](https://discuss.elastic.co/t/query-for-ip-external-ip-addresses-only/299024/1 "2022-03-08T01:29:32Z")
Hi, I am trying to use a KQL query to search for non private (rfc1918) addresses. I am using the following query ```auto AND NOT destination.ip:10.0.0.0/8 OR NOT destination.ip:192.168.0.0/16 OR NOT destination.ip :172.16.0.0/12 ``` The issue is it works but some of the destination.ip results have no data. How do I write the query so that it just displays data where destination.ip : exists Thanks ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [March 8, 2022, 7:55am UTC](https://discuss.elastic.co/t/query-for-ip-external-ip-addresses-only/299024/2 "2022-03-08T07:55:43Z")
Hi Would using the filterbar for this purpose be an option? ![Bildschirmfoto 2022-03-08 um 08.54.34](https://us1.discourse-cdn.com/elastic/original/3X/b/e/bee1a12eeae33525a36c68e16deece347b2da910.png) Best, Matthias ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 5, 2022, 7:56am UTC](https://discuss.elastic.co/t/query-for-ip-external-ip-addresses-only/299024/3 "2022-04-05T07:56:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.