# Storing/searching IPs **URL:** \ **Category:** Elasticsearch\ **Created:** [April 16, 2015, 7:34pm UTC](https://discuss.elastic.co/t/storing-searching-ips/23284 "2015-04-16T19:34:01Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Attila\_Nagy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/attila_nagy/32/46906_2.png) [@Attila\_Nagy](https://discuss.elastic.co/u/Attila_Nagy)\ **Post date:** [April 16, 2015, 7:34pm UTC](https://discuss.elastic.co/t/storing-searching-ips/23284/1 "2015-04-16T19:34:01Z")
Hi, I would like to store IP addresses and subnets (one or more per document) and I would like to search for them with exact or inclusion (does an IP is in any of the subnets stored in the documents). For example a document could have the following: "ip": ["192.168.0.1","192.168.1.0/24","1000::/64"] And searching for 192.168.0.1, 192.168.1.5 or 1000::1 should match it. Are there any chances to have this sometime soon? And if not, what would be the best hack (if any) to support this? Thanks, -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)\ **Post date:** [April 16, 2015, 9:14pm UTC](https://discuss.elastic.co/t/storing-searching-ips/23284/2 "2015-04-16T21:14:01Z")
It is possible to write a plugin with IP/subnet as a new field type. Jörg On Thu, Apr 16, 2015 at 9:34 PM, Attila Nagy [nagy.attila@gmail.com](mailto:nagy.attila@gmail.com) wrote: > Hi, > > I would like to store IP addresses and subnets (one or more per document) > and I would like to search for them with exact or inclusion (does an IP is > in any of the subnets stored in the documents). > > For example a document could have the following: > "ip": ["192.168.0.1","192.168.1.0/24","1000::/64"] > > And searching for 192.168.0.1, 192.168.1.5 or 1000::1 should match it. > > Are there any chances to have this sometime soon? And if not, what would > be the best hack (if any) to support this? > > Thanks, > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAKdsXoH7CSTfX%2B37N6x8RCGOynjxD\_Ktqp0zrG6Oa0oZtjA%3DBQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAKdsXoH7CSTfX%2B37N6x8RCGOynjxD_Ktqp0zrG6Oa0oZtjA%3DBQ%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Charlie\_Hull](https://avatars.discourse-cdn.com/v4/letter/c/6f9a4e/32.png) [@Charlie\_Hull](https://discuss.elastic.co/u/Charlie_Hull)\ **Post date:** [April 17, 2015, 8:12am UTC](https://discuss.elastic.co/t/storing-searching-ips/23284/3 "2015-04-17T08:12:52Z")
On 16/04/2015 20:34, Attila Nagy wrote: > Hi, > > I would like to store IP addresses and subnets (one or more per > document) and I would like to search for them with exact or inclusion > (does an IP is in any of the subnets stored in the documents). > > For example a document could have the following: > "ip": ["192.168.0.1","192.168.1.0/24","1000::/64"] > > And searching for 192.168.0.1, 192.168.1.5 or 1000::1 should match it. > > Are there any chances to have this sometime soon? And if not, what would > be the best hack (if any) to support this? Hi, We did something similar a while ago: > **[Searching for IP addresses in text with Elasticsearch -](https://www.flax.co.uk/blog/2014/06/03/flexible-search-of-structured-numeric-data-with-elasticsearch/)** > > We recently implemented a search solution for a customer using Elasticsearch. Most of their requirements were fairly standard, however they also wanted to be able to search for IP addresses embedded in the document text, using a flexible and precise... Hope you find this useful. Cheers Charlie > Thanks, > > -- > You received this message because you are subscribed to the Google > Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com) > [mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com?utm_medium=email&utm_source=footer). > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Charlie Hull Flax - Open Source Enterprise Search tel/fax: +44 (0)8700 118334 mobile: +44 (0)7767 825828 web: [www.flax.co.uk](http://www.flax.co.uk) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5530C084.7040901%40flax.co.uk](https://groups.google.com/d/msgid/elasticsearch/5530C084.7040901%40flax.co.uk). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Attila\_Nagy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/attila_nagy/32/46906_2.png) [@Attila\_Nagy](https://discuss.elastic.co/u/Attila_Nagy)\ **Post date:** [April 17, 2015, 12:18pm UTC](https://discuss.elastic.co/t/storing-searching-ips/23284/4 "2015-04-17T12:18:54Z")
Hi, Those are the hacks I thought about, although I don't cleary see yet how that would be useful for subnet searches and v4/v6. Basically my problem boils down to: 1. having arbitrary (well, 32 bit for v4 and 128 bit for v6) sized integers 2. searching for range inclusions The first can be solved with some maths, but how can I do the second? I mean is it possible to store a document like this (or any equivalent with nesting etc): subnets: [[100,2000],[300:300],[5000,6000]] so: subnets: [[min1,max1],[min2,max2]...] and have this document returned when I specify any number which is: 1. 100\>=\<2000 2. 300 3. 5000\>=\<6000 ? 1. április 17., péntek 10:13:08 UTC+2 időpontban Charlie Hull a következőt írta: > On 16/04/2015 20:34, Attila Nagy wrote: > > > Hi, > > > > I would like to store IP addresses and subnets (one or more per > > document) and I would like to search for them with exact or inclusion > > (does an IP is in any of the subnets stored in the documents). > > > > For example a document could have the following: > > "ip": ["192.168.0.1","192.168.1.0/24","1000::/64"] > > > > And searching for 192.168.0.1, 192.168.1.5 or 1000::1 should match it. > > > > Are there any chances to have this sometime soon? And if not, what would > > be the best hack (if any) to support this? > > Hi, > > We did something similar a while ago: > > [Searching for IP addresses in text with Elasticsearch -](http://www.flax.co.uk/blog/2014/06/03/flexible-search-of-structured-numeric-data-with-elasticsearch/) > > Hope you find this useful. > > Cheers > > Charlie > > > Thanks, > > > > -- > > You received this message because you are subscribed to the Google > > Groups "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \ > > \<[mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com) \\>. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com) > > > \< > > [https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/3bfede54-5fde-4b65-9947-bfc43e3bdef8%40googlegroups.com?utm_medium=email&utm_source=footer)\>. > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > Charlie Hull > Flax - Open Source Enterprise Search > > tel/fax: +44 (0)8700 118334 > mobile: +44 (0)7767 825828 > web: [www.flax.co.uk](http://www.flax.co.uk) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e0cf6189-036d-4bbd-91c0-5de8d30fd8a3%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e0cf6189-036d-4bbd-91c0-5de8d30fd8a3%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:19am UTC](https://discuss.elastic.co/t/storing-searching-ips/23284/5 "2017-07-06T00:19:05Z")