ES|QL IP functions

ES|QL supports these IP functions:

• CIDR_MATCH
• IP_PREFIX

Syntax

×

Parameters

ip

IP address of type ip (both IPv4 and IPv6 are supported).

blockX

CIDR block to test the IP against.

Description

Returns true if the provided IP is contained in one of the provided CIDR blocks.

Supported types

Example

FROM hosts
| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32")
| KEEP card, host, ip0, ip1

Syntax

×

Parameters

ip

IP address of type ip (both IPv4 and IPv6 are supported).

prefixLengthV4

Prefix length for IPv4 addresses.

prefixLengthV6

Prefix length for IPv6 addresses.

Description

Truncates an IP to a given prefix length.

Supported types

Example

ROW ip4 = to_ip("1.2.3.4"), ip6 = TO_IP("fe80::cae2:65ff:fece:feb9")
| EVAL ip4_prefix = IP_PREFIX(ip4, 24, 0), ip6_prefix = IP_PREFIX(ip6, 0, 112);