# \[SOLVED\] Kibana search on IP part

**URL:** <https://discuss.elastic.co/t/solved-kibana-search-on-ip-part/48969>\
**Category:** Kibana\
**Created:** [May 2, 2016, 2:52pm UTC](https://discuss.elastic.co/t/solved-kibana-search-on-ip-part/48969 "2016-05-02T14:52:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Post date:** [May 2, 2016, 2:52pm UTC](https://discuss.elastic.co/t/solved-kibana-search-on-ip-part/48969/1 "2016-05-02T14:52:27Z")

</div>

Hello,

When I make a curl request against elasticsearch with "\_analyze" option I get tokens that I want (example with ip address 192.168.100.1):

> ```
> "detail" : {
> "custom_analyzer" : true,
> "tokenizer" : {
> "name" : "ip_4_tokenizer",
> "tokens" : [ {
> "token" : "192",
> "start_offset" : 0,
> "end_offset" : 3,
> "type" : "word",
> "position" : 0,
> "positionLength" : 1,
> "bytes" : "[31 39 32]"
> }, {
> "token" : "192.168",
> "start_offset" : 0,
> "end_offset" : 7,
> "type" : "word",
> "position" : 0,
> "positionLength" : 1,
> "bytes" : "[31 39 32 2e 31 36 38]"
> }, {
> "token" : "192.168.100",
> "start_offset" : 0,
> "end_offset" : 11,
> "type" : "word",
> "position" : 0,
> "positionLength" : 1,
> "bytes" : "[31 39 32 2e 31 36 38 2e 31 30 30]"
> }, {
> "token" : "192.168.100.1",
> "start_offset" : 0,
> "end_offset" : 13,
> "type" : "word",
> "position" : 0,
> "positionLength" : 1,
> "bytes" : "[31 39 32 2e 31 36 38 2e 31 30 30 2e 31]"
> 
> ```

Search\_analyzer:

> ```
> "custom-search_analyzer": {
> "type": "custom",
> "tokenizer": "keyword",
> "filter": ["remove_trailing_dot"]
> }
> "remove_trailing_dot": {
> "type": "pattern_replace",
> "pattern": "\\.$",
> "replace": ""
> }
> 
> ```

Custom analyzer:

> ```
> "my_ipv4_analyzer": {
> "type": "custom",
> "tokenizer": "ip_4_tokenizer"
> }
> "ip_4_tokenizer": {
> "type": "path_hierarchy",
> "delimiter": "."
> }
> 
> ```

In kibana when I make a search like (on client field) "192.168.100.1" or "client:192.168.100.1" I get a results. But when I try with "192.168" or "192.168." I didn't get any result.

I don't understand why ?

If you have any idea.

Thanks in advance,  
Alex

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [May 2, 2016, 10:37pm UTC](https://discuss.elastic.co/t/solved-kibana-search-on-ip-part/48969/2 "2016-05-02T22:37:18Z")

</div>

Does it work if you query elasticsearch directly with something like Curl, Postman, or Sense?

Did you [configure](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/analyzer.html) the custom analyzer for your ip field prior to indexing your data?

And if you don't mind me asking, why do you need a custom analyzer? You could search for IPs in a certain range by using wildcards like `client:192.168.*`

---

<div class="post-metadata">

**Author:** ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Post date:** [May 3, 2016, 10:02am UTC](https://discuss.elastic.co/t/solved-kibana-search-on-ip-part/48969/3 "2016-05-03T10:02:40Z")

</div>

Thanks for your answer.

I found my mistake. I tried to update index settings on the fly and it erased some settings because I didn't put them during update.

I delete the index and I put again all the settings and mappings. So now it works.

Thanks again.  
Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:54pm UTC](https://discuss.elastic.co/t/solved-kibana-search-on-ip-part/48969/4 "2017-07-06T13:54:29Z")

</div>