# Wildcard for source.ip field

**URL:** <https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613>\
**Category:** Elasticsearch\
**Created:** [January 27, 2022, 5:01pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613 "2022-01-27T17:01:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [January 27, 2022, 5:01pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613/1 "2022-01-27T17:01:04Z")

</div>

Hi there,

I would like to know how to fix this search (if is possible of course):

```auto
(winlog.channel:"Security" AND (winlog.event_id:"4624" AND winlog.event_data.LogonType:"10") AND (NOT (source.ip:(10.* OR 192.168.* OR 172.31* OR 172.30.* OR 172.29.* OR 172.28.* OR 172.27.* OR 172.26.* OR 172.25.* OR 172.24.* OR 172.23.* OR 172.21.* OR 172.20.* OR 172.19.* OR 172.18.* OR 172.17.* OR 172.16.* OR fd* OR fc* OR 127.0.0.1* OR \:\:1*))))

```

The results I got back is always:

```auto
Can only use prefix queries on keyword, text and wildcard fields - not on [source.ip] which is of type [ip]"

```

Help pls.

Thanks for the attention.

---

<div class="post-metadata">

**Author:** ![mayya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayya/32/83147_2.png) [@mayya](https://discuss.elastic.co/u/mayya)\
**Post date:** [January 27, 2022, 9:17pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613/2 "2022-01-27T21:17:40Z")

</div>

As the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html#query-ip-fields) says "the most common way to query ip addresses is to use the [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) notation": `[ip_address]/[prefix_length]`

For example, to search for `172.30.*`, you can use a query:

```auto
{
  "query": {
    "term": {
      "ip": "172.30.0.0/16"
    }
  }

```

---

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [January 28, 2022, 11:11am UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613/3 "2022-01-28T11:11:27Z")

</div>

That´s great!!! 🙂

My question is, that´s the only way?? If you say so I´m ok....

Thanks

---

<div class="post-metadata">

**Author:** ![mayya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayya/32/83147_2.png) [@mayya](https://discuss.elastic.co/u/mayya)\
**Post date:** [January 28, 2022, 12:08pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613/4 "2022-01-28T12:08:12Z")

</div>

You can also use range query on ip addresses, like:

```auto
{
  "query": {
    "range": {
      "ip": {
        "gte": "172.30.0.0",
        "lte": "172.30.0.1"
      }
    }
  }

```

---

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [January 28, 2022, 7:04pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613/5 "2022-01-28T19:04:51Z")

</div>

Ok, understood! Now I´m trying to use a rule from Elastic using the same schema you just pointed above, but still receiving errors:

Rule:

```auto
event.category:(network or network_traffic) and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and
  not source.ip:(
    10.0.0.0/8 or
    127.0.0.0/8 or
    169.254.0.0/16 or
    172.16.0.0/12 or
    192.0.0.0/24 or
    192.0.0.0/29 or
    192.0.0.8/32 or
    192.0.0.9/32 or
    192.0.0.10/32 or
    192.0.0.170/32 or
    192.0.0.171/32 or
    192.0.2.0/24 or
    192.31.196.0/24 or
    192.52.193.0/24 or
    192.168.0.0/16 or
    192.88.99.0/24 or
    224.0.0.0/4 or
    100.64.0.0/10 or
    192.175.48.0/24 or
    198.18.0.0/15 or
    198.51.100.0/24 or
    203.0.113.0/24 or
    240.0.0.0/4 or
    "::1" or
    "FE80::/10" or
    "FF00::/8"
  ) and
  destination.ip:(
    10.0.0.0/8 or
    172.16.0.0/12 or
    192.168.0.0/16
  )

```

Results:

```auto
Can only use regexp queries on keyword and text fields - not on [source.ip] which is of type [ip]

```

What I´m doing wrong? Just copied and pasted from the elastic page this rule

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2022, 7:05pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613/6 "2022-02-25T19:05:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.