IP field type
editIP field type
editAn ip
field can index/store either IPv4 or
IPv6 addresses.
PUT my-index-000001 { "mappings": { "properties": { "ip_addr": { "type": "ip" } } } } PUT my-index-000001/_doc/1 { "ip_addr": "192.168.1.1" } GET my-index-000001/_search { "query": { "term": { "ip_addr": "192.168.0.0/16" } } }
You can also store ip ranges in a single field using an ip_range data type.
Parameters for ip
fields
editThe following parameters are accepted by ip
fields:
Mapping field-level query time boosting. Accepts a floating point number, defaults
to |
|
|
Marks the field as a time series dimension. Accepts The Dimension fields have the following constraints: |
Should the field be stored on disk in a column-stride fashion, so that it
can later be used for sorting, aggregations, or scripting? Accepts |
|
If |
|
Should the field be searchable? Accepts |
|
Accepts an IPv4 or IPv6 value which is substituted for any explicit |
|
|
Defines what to do if the script defined by the |
|
If this parameter is set, then the field will index values generated by this script, rather than reading the values directly from the source. If a value is set for this field on the input document, then the document will be rejected with an error. Scripts are in the same format as their runtime equivalent, and should emit strings containing IPv4 or IPv6 formatted addresses. |
Whether the field value should be stored and retrievable separately from
the |
Querying ip
fields
editThe most common way to query ip addresses is to use the
CIDR
notation: [ip_address]/[prefix_length]
. For instance:
GET my-index-000001/_search { "query": { "term": { "ip_addr": "192.168.0.0/16" } } }
or
GET my-index-000001/_search { "query": { "term": { "ip_addr": "2001:db8::/48" } } }
Also beware that colons are special characters to the
query_string
query, so ipv6 addresses will
need to be escaped. The easiest way to do so is to put quotes around the
searched value:
GET my-index-000001/_search { "query": { "query_string" : { "query": "ip_addr:\"2001:db8::/48\"" } } }