# Write a regular expression to match on any IP address. How many dns answers contain an IP address?

**URL:** <https://discuss.elastic.co/t/write-a-regular-expression-to-match-on-any-ip-address-how-many-dns-answers-contain-an-ip-address/381084>\
**Category:** Elastic Training\
**Created:** [August 16, 2025, 9:45pm UTC](https://discuss.elastic.co/t/write-a-regular-expression-to-match-on-any-ip-address-how-many-dns-answers-contain-an-ip-address/381084 "2025-08-16T21:45:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mayad\_Koujah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayad_koujah/32/144653_2.png) [@Mayad\_Koujah](https://discuss.elastic.co/u/Mayad_Koujah)\
**Post date:** [August 16, 2025, 9:45pm UTC](https://discuss.elastic.co/t/write-a-regular-expression-to-match-on-any-ip-address-how-many-dns-answers-contain-an-ip-address/381084/1 "2025-08-16T21:45:36Z")

</div>

Hey all — I’m trying to answer this prompt: **“Write a regular expression to match on any IP address. How many DNS answers contain an IP address?”** It is my last question on “ **3.2 - Discover - Searching with KQL and Lucene”** and i have been stuck at it for a good amount of time any help appreciated

Thank you.

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 17, 2025, 3:51am UTC](https://discuss.elastic.co/t/write-a-regular-expression-to-match-on-any-ip-address-how-many-dns-answers-contain-an-ip-address/381084/2 "2025-08-17T03:51:14Z")

</div>

Hello @Mayad_Koujah

Welcome to the Community!!

Training : Elastic Security for SIEM  
3.2 - Discover - Searching with KQL and Lucene:  
Write a regular expression to match on any IP address. How many dns answers contain an IP address?

Since it is a regular expression we need to use Lucene.  
index : ecs-zeek-\*  
Day 0  
dns.answers.name : /([0-9]{1,3}.){3}[0-9]{1,3}/  
We get =\> 8342

Thanks!!

---

<div class="post-metadata">

**Author:** ![Mayad\_Koujah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayad_koujah/32/144653_2.png) [@Mayad\_Koujah](https://discuss.elastic.co/u/Mayad_Koujah)\
**Post date:** [August 22, 2025, 8:31pm UTC](https://discuss.elastic.co/t/write-a-regular-expression-to-match-on-any-ip-address-how-many-dns-answers-contain-an-ip-address/381084/3 "2025-08-22T20:31:46Z")

</div>

thank you so much if you can please provide a quick simple explanation it would be much appreciated

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 23, 2025, 3:24am UTC](https://discuss.elastic.co/t/write-a-regular-expression-to-match-on-any-ip-address-how-many-dns-answers-contain-an-ip-address/381084/4 "2025-08-23T03:24:13Z")

</div>

Sure @Mayad_Koujah , I have shared the explanation.