---
title: ES|QL CIDR_MATCH function
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3028/reference/query-languages/esql/functions-operators/ip-functions/cidr_match
products:
  - Elasticsearch
---

# ES|QL CIDR_MATCH function
## Syntax

![Embedded](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/query-languages/esql/images/functions/cidr_match.svg)


## Parameters

<definitions>
  <definition term="ip">
    IP address of type `ip` (both IPv4 and IPv6 are supported).
  </definition>
  <definition term="blockX">
    CIDR block to test the IP against.
  </definition>
</definitions>


## Description

Returns true if the provided IP is contained in one of the provided CIDR blocks.

## Supported types


| ip  | blockX  | result  |
|-----|---------|---------|
| ip  | keyword | boolean |
| ip  | text    | boolean |


## Example

```esql
FROM hosts
| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32")
| KEEP card, host, ip0, ip1
```


| card:keyword | host:keyword | ip0:ip                    | ip1:ip    |
|--------------|--------------|---------------------------|-----------|
| eth1         | beta         | 127.0.0.1                 | 127.0.0.2 |
| eth0         | gamma        | fe80::cae2:65ff:fece:feb9 | 127.0.0.3 |