# Why search give me strange result?

**URL:** <https://discuss.elastic.co/t/why-search-give-me-strange-result/133146>\
**Category:** Elasticsearch\
**Created:** [May 24, 2018, 12:39pm UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146 "2018-05-24T12:39:33Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vladimir\_Fomin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladimir_fomin/32/31413_2.png) [@Vladimir\_Fomin](https://discuss.elastic.co/u/Vladimir_Fomin)\
**Post date:** [May 24, 2018, 12:39pm UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146/1 "2018-05-24T12:39:33Z")

</div>

Can you explain me why this search string: netflow.ipv4\_src\_addr:[192.168.150.0 TO 192.168.255.255]  
give me ip addresses from 192.168.2.0, 192.168.23.0 etc.  
I expected something like 192.168.150.xx, 192.168.151.xx ... .... ... 192.168.255.255. So, not \<150 in 3 octet!  
How should I make this query? (From 150 to 255 in 3 octet)

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [May 24, 2018, 12:46pm UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146/2 "2018-05-24T12:46:22Z")

</div>

What's your field\_type?  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html)

---

<div class="post-metadata">

**Author:** ![Vladimir\_Fomin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladimir_fomin/32/31413_2.png) [@Vladimir\_Fomin](https://discuss.elastic.co/u/Vladimir_Fomin)\
**Post date:** [May 24, 2018, 12:54pm UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146/3 "2018-05-24T12:54:14Z")

</div>

netflow.ipv4\_dst\_addr string   
netflow.ipv4\_dst\_addr.keyword string   
netflow.ipv4\_src\_addr string   
netflow.ipv4\_src\_addr.keyword string

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [May 24, 2018, 7:00pm UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146/4 "2018-05-24T19:00:53Z")

</div>

Because you have a string datatype, your search string gets separated by dost and searched by parts.

Try using `IP` datatype:  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html)

---

<div class="post-metadata">

**Author:** ![Vladimir\_Fomin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladimir_fomin/32/31413_2.png) [@Vladimir\_Fomin](https://discuss.elastic.co/u/Vladimir_Fomin)\
**Post date:** [May 25, 2018, 5:17am UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146/5 "2018-05-25T05:17:11Z")

</div>

ok, should I change the datatype?  
I don't clearly understand what I should do. Is "reindex" is my case?  
I tried to do this but it doesn't make result.

```
PUT /netflow-2018.05.18
{
"mappings": {
  "netflow": {
          "dynamic": true,
          "properties": {
            "ipv4_src_addr": {
              "type": "ip"
            },
            "ipv4_dst_addr": {
              "type": "ip"
            },
            "xlate_src_addr_ipv4": {
              "type": "ip"
            },
            "xlate_dst_addr_ipv4": {
              "type": "ip"
            }
          }
        }
}

}

```

The result is an error.

```
{
  "error": {
    "root_cause": [
      {
        "type": "resource_already_exists_exception",
        "reason": "index [netflow-2018.05.18/jZOpeOEATcekrz6VSMZHBA] already exists",
        "index_uuid": "jZOpeOEATcekrz6VSMZHBA",
        "index": "netflow-2018.05.18"
      }
    ],
    "type": "resource_already_exists_exception",
    "reason": "index [netflow-2018.05.18/jZOpeOEATcekrz6VSMZHBA] already exists",
    "index_uuid": "jZOpeOEATcekrz6VSMZHBA",
    "index": "netflow-2018.05.18"
  },
  "status": 400
}
```

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [May 28, 2018, 6:51am UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146/6 "2018-05-28T06:51:24Z")

</div>

If your doing a reindex, the output should be a new existing index.

I suggest you first create an index with predefined mapping and then reindex data into it or fill in data from scratch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2018, 6:51am UTC](https://discuss.elastic.co/t/why-search-give-me-strange-result/133146/7 "2018-06-25T06:51:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.