# Use CIDR masks from Discover tab?

**URL:** <https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504>\
**Category:** Kibana\
**Created:** [July 29, 2015, 3:42pm UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504 "2015-07-29T15:42:32Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rob\_Buhler](https://avatars.discourse-cdn.com/v4/letter/r/b3f665/32.png) [@Rob\_Buhler](https://discuss.elastic.co/u/Rob_Buhler)\
**Post date:** [July 29, 2015, 3:42pm UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504/1 "2015-07-29T15:42:32Z")

</div>

I know there is the ability in Kibana to search by an IP range  
ex: ip:["128.0.0.0" TO "191.255.255.255"]

and there is also the ability to use CIDR masks when creating a new  
aggregation (Visualization tab).

My question is can you somehow use CIDR masks from the Discovery view?

ex: ip:"128.0.0/2"

every variation I have tried has resulted in an error for invalid syntax or there is an error with the request.

If this does not exist yet, is it something that is planned for a future release?

thanks.

---

<div class="post-metadata">

**Author:** ![Rob\_Buhler](https://avatars.discourse-cdn.com/v4/letter/r/b3f665/32.png) [@Rob\_Buhler](https://discuss.elastic.co/u/Rob_Buhler)\
**Post date:** [July 29, 2015, 4:35pm UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504/2 "2015-07-29T16:35:43Z")

</div>

just happened to see this ticket - [https://github.com/elastic/elasticsearch/issues/7464](https://github.com/elastic/elasticsearch/issues/7464)

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [July 30, 2015, 4:40am UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504/3 "2015-07-30T04:40:49Z")

</div>

Yeah, until Elasticsearch natively supports it in [Lucene query syntax](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html), Kibana Discover search won't support it either. The query from the search bar is passed straight through to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![Rob\_Buhler](https://avatars.discourse-cdn.com/v4/letter/r/b3f665/32.png) [@Rob\_Buhler](https://discuss.elastic.co/u/Rob_Buhler)\
**Post date:** [July 30, 2015, 12:18pm UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504/4 "2015-07-30T12:18:15Z")

</div>

thanks for the reply! I'll wait and see if this gets added to Elasticsearch

---

<div class="post-metadata">

**Author:** ![matwil42](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@matwil42](https://discuss.elastic.co/u/matwil42)\
**Post date:** [September 23, 2015, 4:39pm UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504/5 "2015-09-23T16:39:22Z")

</div>

This would be extremely useful for our firewall team and might help us displace some more Splunk!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 23, 2015, 11:12pm UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504/6 "2015-12-23T23:12:19Z")

</div>

Turns out you can do this using this query - `{"term" : {"ip" : "192.168.0.0/24"}}` (NOTE: applies to ES 2.2 only sorry!).

Thanks to @lukas for digging it up 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:06pm UTC](https://discuss.elastic.co/t/use-cidr-masks-from-discover-tab/26504/7 "2017-07-06T14:06:05Z")

</div>