# Searching for a broadcast IP in Kibana

**URL:** <https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575>\
**Category:** Kibana\
**Created:** [September 15, 2016, 7:24am UTC](https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575 "2016-09-15T07:24:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mahdy\_S](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@Mahdy\_S](https://discuss.elastic.co/u/Mahdy_S)\
**Post date:** [September 15, 2016, 7:24am UTC](https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575/1 "2016-09-15T07:24:32Z")

</div>

Dear Experts,

I have uploaded some syslogs through logstash into Elasticsearch and I am visualising these logs with Kibana 4.5.1. One of the fields is the destination IP and I have configured that as an IP address in Elastic ("type" : "ip"). Now I'm interested in finding the broadcast messages by searching for all messages with a destination IP ending with 255. I have tried entering **Source\_IP:\*.\*.\*.255** in Kibana but this gave me the following error message: **NumericTokenStream does not support CharTermAttribute**. Is there another syntax for doing this?

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [September 16, 2016, 4:56am UTC](https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575/2 "2016-09-16T04:56:39Z")

</div>

Performing a [wildcard query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html) can be very slow as the data is not indexed. With the IP field type you can search on [ranges](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html). Do you have multiple subnets you need to search across where the broadcast IP would differ?

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [September 16, 2016, 5:09am UTC](https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575/3 "2016-09-16T05:09:20Z")

</div>

> [@Mahdy\_S](#):
>
> `Source_IP:*.*.*.255`

This should be `Source_IP:*.255`

---

<div class="post-metadata">

**Author:** ![Mahdy\_S](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@Mahdy\_S](https://discuss.elastic.co/u/Mahdy_S)\
**Post date:** [September 16, 2016, 7:00am UTC](https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575/4 "2016-09-16T07:00:40Z")

</div>

`Source_IP:*.255` gives the same error. I suppose it would work if the data was of type string not of type IP

---

<div class="post-metadata">

**Author:** ![Mahdy\_S](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@Mahdy\_S](https://discuss.elastic.co/u/Mahdy_S)\
**Post date:** [September 16, 2016, 7:04am UTC](https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575/5 "2016-09-16T07:04:13Z")

</div>

Ranges would be helpful If I have the opposite of this use case, i.e. if my wildcards where at the end of the IP address not at the beginning. There are no specific subnets, I wanted to search for broadcast messages in general.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:38pm UTC](https://discuss.elastic.co/t/searching-for-a-broadcast-ip-in-kibana/60575/6 "2017-07-06T13:38:56Z")

</div>