IP range aggregation

IP range aggregation #

A multi-bucket aggregation like range, but for IP addresses — buckets are CIDR masks or from/to IP bounds. It answers network-shape questions: which subnet does this traffic belong to, and how much of it is in the private ranges versus the internet.

How it works #

The field’s string values are parsed into 128-bit numbers, with IPv4 mapped into the IPv6 space as ::ffff:a.b.c.d — an order-preserving numeric comparison. From/to buckets are half-open on that number (from inclusive, to exclusive), so IPv4 and IPv6 bounds interoperate; 10.0.0.0 sorts before 192.168.0.0 sorts before 2001:db8::.