Skip to content

ip_range ipv4 to ipv6 term query unexpected results #124793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DanielBrown2023 opened this issue Mar 13, 2025 · 1 comment
Open

ip_range ipv4 to ipv6 term query unexpected results #124793

DanielBrown2023 opened this issue Mar 13, 2025 · 1 comment
Assignees
Labels
>bug priority:normal A label for assessing bug priority to be used by ES engineers :Search Relevance/Search Catch all for Search Relevance Team:Search Relevance Meta label for the Search Relevance team in Elasticsearch

Comments

@DanielBrown2023
Copy link

Elasticsearch Version

8.17.1

Installed Plugins

No response

Java Version

bundled

OS Version

Elastic Cloud

Problem Description

Term query of ip_range type field does not return expected documents.

When docs ip_range field contains "{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:0:ffff:ffff" }}" or smaller "lte" values consisting of ipv6 strings, terms queries will not match a ipv4 string even when the value is in the range of the ip_range field.

# Bug Edge cases
PUT _index_template/ip_range_index
{
    "index_patterns": ["ip_range_index"],
    "template": {
        "mappings": {
            "properties": {
                "ip_range": {
                    "type": "ip_range"
                }
            }
        }
    }
}
POST _bulk
{ "index" : { "_index" : "ip_range_index", "_id" : "1" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "2" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:ffff:ffff:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "3" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:ffff:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "4" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "5" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "6" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "7" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:0:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "8" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:0:0:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "9" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:0:0:0" }}

# query returns 9 hits as expected
GET ip_range_index/_search
{
    "query": {
        "term": {
          "ip_range": {
            "value": "::0"
          }
        }
    }
}

# query returns 6 hits, should be 9? 
GET ip_range_index/_search
{
    "query": {
        "term": {
          "ip_range": {
            "value": "0.0.0.0"
          }
        }
    }
}

Expectation would be to have both the IPv4 and IPv6 version of this query return all 9 documents

Steps to Reproduce

# Bug Edge cases
PUT _index_template/ip_range_index
{
    "index_patterns": ["ip_range_index"],
    "template": {
        "mappings": {
            "properties": {
                "ip_range": {
                    "type": "ip_range"
                }
            }
        }
    }
}
POST _bulk
{ "index" : { "_index" : "ip_range_index", "_id" : "1" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "2" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:ffff:ffff:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "3" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:ffff:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "4" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:ffff:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "5" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:ffff:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "6" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:ffff:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "7" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:0:ffff:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "8" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:0:0:ffff" }}
{ "index" : { "_index" : "ip_range_index", "_id" : "9" } }
{"ip_range": { "gte": "0:0:0:0:0:0:0:0", "lte": "0:0:0:0:0:0:0:0" }}

# query returns 9 hits as expected
GET ip_range_index/_search
{
    "query": {
        "term": {
          "ip_range": {
            "value": "::0"
          }
        }
    }
}

# query returns 6 hits, should be 9? 
GET ip_range_index/_search
{
    "query": {
        "term": {
          "ip_range": {
            "value": "0.0.0.0"
          }
        }
    }
}

Logs (if relevant)

No response

@DanielBrown2023 DanielBrown2023 added >bug needs:triage Requires assignment of a team area label labels Mar 13, 2025
@javanna javanna added :Search Relevance/Search Catch all for Search Relevance and removed needs:triage Requires assignment of a team area label labels Mar 14, 2025
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-search-relevance (Team:Search Relevance)

@elasticsearchmachine elasticsearchmachine added the Team:Search Relevance Meta label for the Search Relevance team in Elasticsearch label Mar 14, 2025
@tteofili tteofili self-assigned this Mar 18, 2025
@tteofili tteofili added the priority:high A label for assessing bug priority to be used by ES engineers label Mar 25, 2025
@tteofili tteofili added priority:normal A label for assessing bug priority to be used by ES engineers and removed priority:high A label for assessing bug priority to be used by ES engineers labels Apr 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>bug priority:normal A label for assessing bug priority to be used by ES engineers :Search Relevance/Search Catch all for Search Relevance Team:Search Relevance Meta label for the Search Relevance team in Elasticsearch
Projects
None yet
Development

No branches or pull requests

4 participants