Does Elastic range enrich processor supports IPV6 ips?

Question

I am trying to add Elastic range enrich processor in ingest pipeline and I have a IPV6 documents.

Reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/range-enrich-policy-type.html

Just wanted to know whether Elastic range enrich processor supports IPV6 ips it's working fine with IPV4 ips.

Answer 1

Yes it is.

PUT /networks?pretty
{
  "mappings": {
    "properties": {
      "range": { "type": "ip_range" },
      "name": { "type": "keyword" },
      "department": { "type": "keyword" }
    }
  }
}

PUT /networks/_doc/1?refresh=wait_for&pretty
{
  "range": "2001:db8::/48",
  "name": "production",
  "department": "OPS"
}

PUT /_enrich/policy/networks-policy?pretty
{
  "range": {
    "indices": "networks",
    "match_field": "range",
    "enrich_fields": ["name", "department"]
  }
}

POST /_enrich/policy/networks-policy/_execute?pretty

PUT /_ingest/pipeline/networks_lookup
{
  "processors" : [
    {
      "enrich" : {
        "description": "Add 'network' data based on 'ip'",
        "policy_name": "networks-policy",
        "field" : "ip",
        "target_field": "network",
        "max_matches": "10"
      }
    }
  ]
}

PUT /test_networks/_doc/my_id?pipeline=networks_lookup&pretty
{
  "ip": "2001:db8::"
}

GET /test_networks/_doc/my_id