# Return ip field from inner\_hit in dot-decimal format **URL:** \ **Category:** Elasticsearch\ **Created:** [January 29, 2016, 8:01am UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452 "2016-01-29T08:01:35Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [January 29, 2016, 8:01am UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/1 "2016-01-29T08:01:35Z")
I have been posting an issue on Github: > where I describe the problem of retrieving a field of "ip" from an inner\_hit in the correct format. @jpountz wrote that this is not a bug, but I have found no way of solving this problem. I have now tried to use filtering on the inner\_hit instead: `"inner_hits" : {"_source":"network.http.packet.dstip"}` but this won't return anything if I set `_source=False` in the query itself, I get nothing back. Alternatively, this: `_source=".network.http.packet.*"` also returns nothing, and this: `_source=".network.http.packet.dstip""` returns all entries in this branch (so not just the inner\_hits). Which is frustrating. Is there a method I have overlooked? ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 1, 2016, 10:33am UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/2 "2016-02-01T10:33:31Z")
Is my use case too special or is there simply no solution? 😉 ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 3, 2016, 12:21pm UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/3 "2016-02-03T12:21:05Z")
So 22 people have read this question, but no replies ☹ Should I open a new issue on Github then? Btw, I also don't understand why in my Github example (see above), I get e.g. 386205091 as a match for 184.28.188.99 (which has a binary value of 10111000000111001011110001100011 and decimal equivalent of 3088890979). ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 5, 2016, 10:21am UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/4 "2016-02-05T10:21:47Z")
I have done further tests in the meantime and improved my syntax skills ;-), and now at least I only get back correct matches. Right now the only solution I can see for myself is to convert each ip address to dot-decimal format using some custom function which is an awkward workaround (see the wonderful example for "PHP example to convert decimal to IP" here: [http://stackoverflow.com/questions/12130464/ip-address-conversion-to-decimal-and-vice-versa](http://stackoverflow.com/questions/12130464/ip-address-conversion-to-decimal-and-vice-versa)). This is really bad and should be fixed in ES. ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 9, 2016, 11:37am UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/5 "2016-02-09T11:37:48Z")
I have opened an issue on Github: > but the ES team closed it like the one before (see first post), so I suppose they think there is some way to solve it with the existing DSL. Who can give advice? ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 9, 2016, 1:25pm UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/6 "2016-02-09T13:25:19Z")
This issue actually takes me a step further to this question: How is source filtering supposed to work for inner\_hits? [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-inner-hits.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-inner-hits.html) says that it does, but I have not seen any example, and I could not get it to work so far (see my explanation in the very first entry I posted here above). I have also noticed that the problem with the formatting does not only affect IP addresses, but also e.g. analyzed strings. If I request these using fielddata\_fields, I receive a list of all the tokens that my original string was split up into, but not the original string. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 9, 2016, 4:24pm UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/7 "2016-02-09T16:24:51Z")
What this `"_source": "network.http.packet.dstip"` gives? ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 9, 2016, 6:17pm UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/8 "2016-02-09T18:17:00Z")
The \_source element for my inner\_hits remains empty whatever I try. Funnily, I can return the item through the document \_source, but then it returns all entries. So basically \_source filtering seems to fail for inner\_hits. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 9, 2016, 6:44pm UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/9 "2016-02-09T18:44:08Z")
Can you reproduce it with a full SENSE example? As a gist, it would be fantastic! David Pilato- Developer | Evangelist @dadoonet|@elasticfr ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 10, 2016, 8:40am UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/10 "2016-02-10T08:40:43Z")
Hi David and anyone interested in this issue: I have found the SOLUTION 😄 In the `_source` part of the `inner_hits` definition, you must list the fields using the RELATIVE path to the nested node. I.e. if the nested path is: `network.http.packet` and the field you are looking for is: `network.http.packet.dstip` then you need to write `"inner_hits" : {"_source":"dstip"}` while for fielddata\_fields, it must be: `"inner_hits" : {"fielddata_fields":"network.http.packet.dstip"}` What a Überraschung! 😉 ---
**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Post date:** [February 10, 2016, 9:01am UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/11 "2016-02-10T09:01:10Z")
I added this information as a PR to the ES reference, see [https://github.com/elastic/elasticsearch/pull/16571](https://github.com/elastic/elasticsearch/pull/16571) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:17pm UTC](https://discuss.elastic.co/t/return-ip-field-from-inner-hit-in-dot-decimal-format/40452/12 "2017-07-05T23:17:40Z")