IP address field type

    To represent IP address ranges, there is an IP .

    Create a mapping with an IP address:

    copy

    Index a document with an IP address:

    2. {
    3. }

    Query an index for a specific IP address:

    copy

    You can query an index for an IP address in Classless Inter-Domain Routing (CIDR) notation. Using CIDR notation, specify the IP address and the prefix length (0–32), separated by /. For example, the prefix length of 24 will match all IP addresses with the same initial 24 bits.

    Example query in IPv4 format

    1. GET testindex/_search 
    2. {
    3.   "query": {
    4.     "term": {
    5.       "ip_address": "10.24.34.0/24"
    6.     }

    copy

    Example query in IPv6 format

    If you use an IP address in IPv6 format in a query_string query, you need to escape : characters because they are parsed as special characters. You can accomplish this by wrapping the IP address in quotation marks and escaping those quotation marks with \.

    1. GET testindex/_search 
    2. {
    3.   "query" : {
    4.     "query_string": {
    5.       "query": "ip_address:\"2001:DB8::/24\""
    6.     }
    7. }

    copy

    The following table lists the parameters accepted by ip field types. All parameters are optional.