Visualization - Group IP Addresses by /24 Subnet

[iamkelvinloke (Kelvin Loke)]

Happy in using Elastic Stack 5 with Ingest mode (Filebeat) now

I have a visualization (Data Table) to show all the source IP count to visit my web server.

clientip: Ascending Count
1.10.100.151 1000
1.10.100.152 1000
1.10.101.153 500
1.10.101.153 200
1.10.200.160 30
1.164.10.238 10

How can I group them by /24 subnet to become the list like below?

clientip: Ascending Count
1.10.100.0/24 2000
1.10.101.0/24 1000
1.10.200.0/24 30
1.164.10.0/24 10

[tylersmalley]

Elasticsearch allows you to create aggregation buckets, including using a CIDR mask but it doesn't appear you can do it automatically. You might be able to create a custom tokenizer to accomplish this.