# Searching IP Address with regex **URL:** \ **Category:** Kibana\ **Created:** [March 15, 2024, 9:58am UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465 "2024-03-15T09:58:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![martcus](https://avatars.discourse-cdn.com/v4/letter/m/f14d63/32.png) [@martcus](https://discuss.elastic.co/u/martcus)\ **Post date:** [March 15, 2024, 9:58am UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/1 "2024-03-15T09:58:46Z")
Hi All, I need to search for the presence of ip addresses on application logs in the following format: - [http://xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx/) - [https://xxx.xxx.xxx.xxx](https://xxx.xxx.xxx.xxx/) The field could also contain information other than the ip address I wrote the regex (`https?://([0-9]{1,3}\.){3}[0-9]{1,3}`) and tested it via regex101. I created a test index to verify the search, inserted in the DSL query returns no results (via Kibana) : ```auto { "regexp": { "message": { "case_insensitive": true, "value": "https?://([0-9]{1,3}\.){3}[0-9]{1,3}" } } } ``` If I put: - `"https?"`: returns document - `"([0-9]{1,3}{3}[0-9]{1,3}"`: returns documents - `"https?:"`: does not return documents - `"https?://([0-9]{1,3}{3}[0-9]{1,3}"`: does not return documents - `"https?:\\/\\/([0-9]{1,3}{3}[0-9]{1,3}"`: does not return documents - `"https?\\:\\/\\/([0-9]{1,3}{3}[0-9]{1,3}"`: does not return documents Can anyone help me? Currently the elastic stack in use is at version 8.11.1. Thanks ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 15, 2024, 8:22pm UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/2 "2024-03-15T20:22:07Z")
It depends on the mapping used for the `message` field I think. If it's not a `keyword` or a `wildcard` type, that might not work. See [Keyword type family | Elasticsearch Guide [8.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/keyword.html#wildcard-field-type) for more details. ---
**Author:** ![martcus](https://avatars.discourse-cdn.com/v4/letter/m/f14d63/32.png) [@martcus](https://discuss.elastic.co/u/martcus)\ **Post date:** [March 18, 2024, 9:16am UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/3 "2024-03-18T09:16:00Z")
Hi, thanks for your reply! I performed another test by creating an index with a wildcard field and the regex does not work. If the mapping is wrong I can't explain why the first regex works but as soon as I insert the character ":" it stops working. Thanks ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 18, 2024, 9:29am UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/4 "2024-03-18T09:29:51Z")
Could you provide a full recreation script as described in [About the Elasticsearch category](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will help to better understand what you are doing. Please, try to keep the example as simple as possible. A full reproduction script is something anyone can **copy and paste in Kibana dev console** , click on the run button to reproduce your use case. It will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer. Have a look at the [Elastic Stack and Solutions Help ยท Forums and Slack | Elastic](https://elastic.co/community/help) page. It contains also lot of useful information on how to ask for help. ---
**Author:** ![martcus](https://avatars.discourse-cdn.com/v4/letter/m/f14d63/32.png) [@martcus](https://discuss.elastic.co/u/martcus)\ **Post date:** [March 18, 2024, 1:51pm UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/5 "2024-03-18T13:51:54Z")
Hi, please find below my test script. Thanks you very much! ```auto # Create index PUT /regex-test { "mappings": { "properties": { "@timestamp": { "type": "date" }, "message": { "type": "text" } } } } # Populate index with some test cases POST /regex-test/_doc { "@timestamp": "2024-03-18T13:00:00", "message": "Correct case https://192.168.1.1/" } POST /regex-test/_doc { "@timestamp": "2024-03-18T13:00:00", "message": "Correct https://192.168.1.1/second/third" } POST /regex-test/_doc { "@timestamp": "2024-03-18T13:00:00", "message": "Correct case: http://192.168.1.1" } POST /regex-test/_doc { "@timestamp": "2024-03-18T13:00:00", "message": "No correct case: 192.168.1.1/" } POST /regex-test/_doc { "@timestamp": "2024-03-18T13:00:00", "message": "No correct https://www.google.it" } # Result found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": "([0-9]{1,3}\\.){3}[0-9]{1,3}" } } } } # Result found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": "https?" } } } } # Result NOT found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": "https?:" } } } } # Result NOT found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": "https?://([0-9]{1,3}\\.){3}[0-9]{1,3}" } } } } ``` ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 18, 2024, 2:23pm UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/6 "2024-03-18T14:23:12Z")
What about this? ```auto # Create index DELETE /regex-test PUT /regex-test { "mappings": { "properties": { "message": { "type": "wildcard" } } } } # Populate index with some test cases POST /regex-test/_doc { "message": "Correct case https://192.168.1.1/" } POST /regex-test/_doc { "message": "Correct https://192.168.1.1/second/third" } POST /regex-test/_doc { "message": "Correct case: http://192.168.1.1" } POST /regex-test/_doc { "message": "No correct case: 192.168.1.1/" } POST /regex-test/_doc { "message": "No correct https://www.google.it" } # Result found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": "([0-9]{1,3}\\.){3}[0-9]{1,3}" } } } } # Result found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": ".*https?.*" } } } } # Result NOT found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": ".*https?:.*" } } } } # Result NOT found GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": ".*https?://([0-9]{1,3}\\.){3}[0-9]{1,3}" } } } } ``` ---
**Author:** ![martcus](https://avatars.discourse-cdn.com/v4/letter/m/f14d63/32.png) [@martcus](https://discuss.elastic.co/u/martcus)\ **Post date:** [April 3, 2024, 12:36pm UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/8 "2024-04-03T12:36:16Z")
Thank you so much @dadoonet ! It works now! I only changed the regex in "._https?://([0-9]{1,3}\.){3}[0-9]{1,3}._". And now the mapping of the message field must be updated (from text to wildcard/keyword). Thank you again. Have a nice day Final Solution: ```auto # Create index DELETE /regex-test PUT /regex-test { "mappings": { "properties": { "message": { "type": "wildcard" } } } } # Populate index with some test cases POST /regex-test/_doc { "message": "Correct case https://192.168.1.1/" } POST /regex-test/_doc { "message": "Correct https://192.168.1.1/second/third" } POST /regex-test/_doc { "message": "Correct case: http://192.168.1.1" } POST /regex-test/_doc { "message": "No correct case: 192.168.1.1/" } POST /regex-test/_doc { "message": "No correct https://www.google.it" } # Query GET /regex-test/_search { "query": { "regexp": { "message": { "case_insensitive": true, "value": ".*https?://([0-9]{1,3}\\.){3}[0-9]{1,3}.*" } } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 1, 2024, 12:36pm UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465/9 "2024-05-01T12:36:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.