This version of the OpenSearch documentation is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

IP range aggregations

The ip_range aggregation is for IP addresses. It works on ip type fields. You can define the IP ranges and masks in the CIDR notation.

  1. GET opensearch_dashboards_sample_data_logs/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.     "access": {
  6.       "ip_range": {
  7.         "field": "ip",
  8.         "ranges": [
  9.           {
  10.             "from": "1.0.0.0",
  11.             "to": "126.158.155.183"
  12.           },
  13.           {
  14.             "mask": "1.0.0.0/8"
  15.           }
  16.         ]
  17.       }
  18.     }
  19.   }
  20. }

copy

Example response

  1. ...
  2. "aggregations" : {
  3.   "access" : {
  4.     "buckets" : [
  5.       {
  6.         "key" : "1.0.0.0/8",
  7.         "from" : "1.0.0.0",
  8.         "to" : "2.0.0.0",
  9.         "doc_count" : 98
  10.       },
  11.       {
  12.         "key" : "1.0.0.0-126.158.155.183",
  13.         "from" : "1.0.0.0",
  14.         "to" : "126.158.155.183",
  15.         "doc_count" : 7184
  16.       }
  17.     ]
  18.   }
  19.  }
  20. }

If you add a document with malformed fields to an index that has ip_range set to false in its mappings, OpenSearch rejects the entire document. You can set ignore_malformed to true to specify that OpenSearch should ignore malformed fields. The default is false.

  1. ...
  2. "mappings": {
  3.   "properties": {
  4.     "ips": {
  5.       "type": "ip_range",
  6.       "ignore_malformed": true
  7.     }
  8.   }
  9. }