Elasticsearch: Search for IP addresses with CIDR notation, in query_string

[avleen]

Today we can search for ranges IP addresses in fields with a query string query like this:
ip_address:[10.0.0.0 TO 10.255.255.255]

It would be great if we could do:
ip_address:10.0.0.0/8 or ip_address:10/8.

This is mostly useful in kibana, where all queries are sent at query_string queries. I understand that ip_range aggregation currently supports this. Would be nice in a QSQ :-)

[td-edge]

+1 This would be a big help if we could search without the ranges.

[webmstr]

+1

[zaakiy]

+1

[Pytlicek]

+1

[JiounDai]

but
"must_not": [
{
"query_string": {
"query": "clientip:[10.44.0.0 TO 10.44.255.255]"
}
}
]
can not work well

[ajmurmann]

+1

[torrancew]

+1

[anujsrc]

+1

[SrikanthKS]

+1

[xande]

+1

[jjunqueira]

+1

[kjelle]

+1

[LxiaoGirl]

How to use this?

[djwmarks]

+1

[daguy666]

+1

[kiwiz]

+1

[orangey]

+1

[german23]

+1

[pemontto]

+1

[jpountz]

Closed via #14773

[ave19]

Our whole life is CIDR. +infinity!

[marvinwankersteen]

Can please someone tell me how to use it in Kibana? I use elasticsearch 5.6.4 and kibana 5.6.
We push netflows from a cisco asa to elasticsearch. I don't want to see the private networks. So I tried the query filter netflow.ipv4_src_addr: "172.16.0.0/16" but that doesn't work.

Edit:
I found the problem. The fields in the index were wrong. I had to reindex the index. I found the solution here: https://www.elastic.co/guide/en/elasticsearch/reference/6.0/docs-reindex.html

Before I copied the data in the new index, I edited the mappings in the template for the fields netflow.ipv4_src_addr and netflow.ipv4_dst_addr to ip:

"netflow": {
          "dynamic": true,
          "properties": {
            "ipv4_src_addr": {
              "type": "ip"
            },
            "ipv4_dst_addr": {
              "type": "ip"
            },
            "xlate_src_addr_ipv4": {
              "type": "ip"
            },
            "xlate_dst_addr_ipv4": {
              "type": "ip"
            }
          }
        }