Link Search Menu Expand Document Documentation Menu
Documentation

IP address field type

Introduced 1.0

An ip field type contains an IP address in IPv4 or IPv6 format.

To represent IP address ranges, there is an IP range field type.

Example

Create a mapping with an IP address:

PUT testindex 
{
  "mappings" : {
    "properties" :  {
      "ip_address" : {
        "type" : "ip"
      }
    }
  }
}

Index a document with an IP address:

PUT testindex/_doc/1 
{
  "ip_address" : "10.24.34.0"
}

Query an index for a specific IP address:

GET testindex/_search
{
  "query": {
    "term": {
      "ip_address": "10.24.34.0"
    }
  }
}

Searching for an IP address and its associated network mask

You can query an index for an IP address in Classless Inter-Domain Routing (CIDR) notation. Using CIDR notation, specify the IP address and the prefix length, separated by /. The prefix length must be between 0 and 32 for IPv4 addresses and between 0 and 128 for IPv6 addresses. For example, a prefix length of 24 matches all IP addresses that share the same first 24 bits.

Example query in IPv4 format

GET testindex/_search 
{
  "query": {
    "term": {
      "ip_address": "10.24.34.0/24"
    }
  }
}

Example query in IPv6 format

GET testindex/_search 
{
  "query": {
    "term": {
      "ip_address": "2001:DB8::/24"
    }
  }
}

If you use an IP address in IPv6 format in a query_string query, you need to escape : characters because they are parsed as special characters. You can accomplish this by wrapping the IP address in quotation marks and escaping those quotation marks with \.

GET testindex/_search 
{
  "query" : {
    "query_string": {
      "query": "ip_address:\"2001:DB8::/24\""
    }
  }
}

Parameters

The following table lists the parameters accepted by ip field types. All parameters are optional.

Parameter Description
boost A floating-point value that specifies the weight of this field toward the relevance score. Values above 1.0 increase the field’s relevance. Values between 0.0 and 1.0 decrease the field’s relevance. Default is 1.0. Dynamically updatable. For more information, see Boost.
doc_values A Boolean value that specifies if the field should be stored on disk so that it can be used for aggregations, sorting, or scripting. Default is true. For more information, see Doc values.
ignore_malformed A Boolean value that specifies to ignore malformed values and not to throw an exception. Default is false. Dynamically updatable. For more information, see Ignore malformed.
index A Boolean value that specifies whether the field should be searchable. Default is true. For indexes that use a pluggable data format, the default is false, and true is not supported. For more information, see Pluggable data format indexes.
null_value A value to be used in place of null. Must be an IPv4 or IPv6 address. If this parameter is not specified, the field is treated as missing when its value is null. Default is null.
store A Boolean value that specifies whether the field value should be stored and can be retrieved separately from the _source field. Default is false. For more information, see Store.

Derived source

When an index uses derived source, OpenSearch may sort IP address values and remove duplicates in multi-value IP fields during source reconstruction.

Create an index that enables derived source and configures an ip field:

PUT sample-index1
{
  "settings": {
    "index": {
      "derived_source": {
        "enabled": true
      }
    }
  },
  "mappings": {
    "properties": {
      "ip": {
        "type": "ip"
      }
    }
  }
}

Index a document with multiple IP addresses, including duplicates, into the index:

PUT sample-index1/_doc/1
{
  "ip": ["10.16.0.1", "192.168.0.1", "10.16.0.1", "2001:0db8:85a3:0000:0000:8a2e:0370:7334"]
}

After OpenSearch reconstructs _source, the derived _source removes duplicates and sorts the values:

{
  "ip": ["10.16.0.1", "192.168.0.1", "2001:0db8:85a3:0000:0000:8a2e:0370:7334"]
}
350 characters left

Have a question? .

Want to contribute? or .