# Search for IP address does not return results **URL:** \ **Category:** Kibana\ **Tags:** docker\ **Created:** [April 22, 2020, 5:43pm UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326 "2020-04-22T17:43:22Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![opoplawski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opoplawski/32/40442_2.png) [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Post date:** [April 22, 2020, 5:43pm UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/1 "2020-04-22T17:43:22Z")
I'm trying to search for an IP (example query on search page: 127.0.0.1) in the filebeat-\* index, and the results indicate 0. If I put \*.ip:127.0.0.1 it works fine (I get results with desintation and source IPs). Appears to be the same with KQL or lucene. My concern and question is, shouldn't kibana be searching all fields if I don't specify one? I'm running kibana 7.6.1. ---
**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\ **Post date:** [April 23, 2020, 5:38pm UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/2 "2020-04-23T17:38:19Z")
Hello Thanks for your question. By default if you are not having any search criteria in the search bar, it shows the data polled for the last hour. I just installed sample data and saw this. ![Screen Shot 2020-04-23 at 10.31.36 AM](https://us1.discourse-cdn.com/elastic/original/3X/7/1/71362cf37f10d4a9d9269c8abaf4a46e99540ba7.png) Is that what you see ? Thanks Rashmi ---
**Author:** ![opoplawski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opoplawski/32/40442_2.png) [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Post date:** [April 24, 2020, 4:25pm UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/3 "2020-04-24T16:25:59Z")
It's not an issue with the time range. ---
**Author:** ![opoplawski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opoplawski/32/40442_2.png) [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Post date:** [April 24, 2020, 4:42pm UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/4 "2020-04-24T16:42:16Z")
I believe the issue is that the various source.ip/destination.ip fields are not listed in the filebeat template query defaul\_field list. I'm not sure why though. ---
**Author:** ![opoplawski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opoplawski/32/40442_2.png) [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Post date:** [April 24, 2020, 4:47pm UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/5 "2020-04-24T16:47:33Z")
Relevant issues - > > > > Describe the enhancement: > When generating the index template from filebeat, ip fields are not included > Describe a specific use case for the enhancement... ---
**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\ **Post date:** [April 24, 2020, 5:57pm UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/6 "2020-04-24T17:57:11Z")
Thanks for posting those links, really helpful. Also copying our infra docker expert @jarpy for more insights into this. He will get back to you when he has some time. Thanks Rashmi ---
**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\ **Post date:** [April 27, 2020, 12:08am UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/7 "2020-04-27T00:08:47Z")
It's a little bit out of my domain, by I think that @opoplawski is on the right track with those issues. We should see if we can get the Beats team to address them. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 25, 2020, 12:08am UTC](https://discuss.elastic.co/t/search-for-ip-address-does-not-return-results/229326/8 "2020-05-25T00:08:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.