Search according to field's type IP?

Graylog Central (peer support)
1

Elasticsearch supports field type IP IP datatype | Elasticsearch Guide [6.8] | Elastic
which supports search by network mask.

PUT my_index/_doc/1
{
  "ip_addr": "192.168.1.1"
}

GET my_index/_search
{
  "query": {
    "term": {
      "ip_addr": "192.168.0.0/16"
    }
  }
}

Is it possible in Graylog to use this kind of query?

2

Have you tried to create own mapping?

3

Yes, I tried and my mapping is ok - field type is ip(which internally is still a string).
But my question is about frontend part, not about backend.
Probably this kind of query is not supported at all (as it seems from my tests).
Or it requires some sophisticated escaping.
Or something else - I don’t know, that’s why I’m asking here

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.