How to query IP range in Elastic search?

问题

I want to query IP range from:172.16.0.0 to 172.31.0.0 in ELK

I try two query methods, but fail.

{
  "query": {
    "bool": {
      "should": [
        {
          "regexp": {
            "DstIP": "172.(3[0-1]|1[6-9]|2[0-9]).*"
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

{
  "query": {
    "range": {
      "DstIP": {
        "gte": "172.16.0.0",
        "lte": "172.31.0.0"
      }
    }
  }
}

How can query IP range in ELK?

回答1:

For range queries to work correctly on IP values it is necessary to define the field data type as ip.

Below is the working example with mapping, sample docs, and search query.

Index Mapping:

{
  "mappings": {
    "properties": {
      "dest": {
        "type": "ip"
      }
    }
  }
}

Index sample data:

Then I've taken a couple of sample documents like this:

{ "dest":"172.16.0.0"}
{ "dest":"172.31.0.0"}
{ "dest":"172.21.0.0"}
{ "dest":"172.1.0.0" }
{ "dest":"172.12.0.0"}

Search Query :

{
  "query": {
    "range": {
      "dest": {
        "gte": "172.16.0.0",
        "lte": "172.31.0.0"
      }
    }
  }
}

Search Result :

 "hits": [
         {
            "_index": "foo4",
            "_type": "_doc",
            "_id": "1",
            "_score": 1.0,
            "_source": {
               "dest": "172.16.0.0"
            }
         },
         {
            "_index": "foo4",
            "_type": "_doc",
            "_id": "2",
            "_score": 1.0,
            "_source": {
               "dest": "172.31.0.0"
            }
         },
         {
            "_index": "foo4",
            "_type": "_doc",
            "_id": "3",
            "_score": 1.0,
            "_source": {
               "dest": "172.21.0.0"
            }
         }
      ]

来源：https://stackoverflow.com/questions/62506849/how-to-query-ip-range-in-elastic-search