All Implemented Interfaces:
NamedWriteable, Writeable, TranslationAware, TranslationAware.SingleValueTranslationAware, Resolvable, EvaluatorMapper

public class CIDRMatch extends EsqlScalarFunction implements TranslationAware.SingleValueTranslationAware
This function takes a first parameter of type IP, followed by one or more parameters evaluated to a CIDR specification:
  • a string literal;
  • a field of type keyword;
  • a function outputting a keyword.

The function will match if the IP parameter is within any (not all) of the ranges defined by the provided CIDR specs.

Example: `| eval cidr="10.0.0.0/8" | where cidr_match(ip_field, "127.0.0.1/30", cidr)`