IP and CIDR operators

FuseQL provides operators for working with IP addresses and CIDR notation, enabling network-level analysis of log data.

comparecidrprefix

Checks whether two IPv4 addresses share the same network prefix at a given CIDR prefix length. Returns true if both addresses fall within the same subnet, false otherwise. Use this to test whether a client IP belongs to a specific network range.

Syntax

| comparecidrprefix(<ipv4String1>, <ipv4String2>, <prefixLength>) as <alias>
none

Parameters

Parameter Required Description

<ipv4String1>

Yes

A string field or literal containing the first IPv4 address to compare.

<ipv4String2>

Yes

A string field or literal containing the second IPv4 address (typically the network base address).

<prefixLength>

Yes

An integer from 0 to 32 specifying the number of network bits to compare.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether two IP addresses fall within the same /24 subnet.

source="nginx"
| compareCIDRPrefix("10.20.15.214", "10.20.15.1", 24) as same_net
| count by same_net
Expected output
same_net _count

True

198333

For example, compareCIDRPrefix("10.20.15.214", "10.20.15.1", 24) returns true because both addresses share the same 10.20.15.x subnet. Narrower prefix lengths (larger number) require addresses to match more bits; /32 requires an exact match. Use this operator to test subnet membership without computing explicit numeric ranges.

getcidrprefix

Returns the network address (prefix) for an IPv4 address given a CIDR prefix length. The host bits are zeroed out to produce the network identifier. Use this to group IP addresses by subnet for traffic analysis or access-control auditing.

Syntax

| getcidrprefix(<ipv4String>, <prefixLength>) as <alias>
none

Parameters

Parameter Required Description

<ipv4String>

Yes

A string field or literal containing a dot-decimal IPv4 address.

<prefixLength>

Yes

An integer from 0 to 32 specifying the number of network bits.

as <alias>

Yes

Name for the string output column.

Example

Return the /16 network prefix for a known IPv4 address.

source="nginx"
| getCIDRPrefix("10.20.15.214", 16) as subnet
| count by subnet
Expected output
subnet _count

10.20.0.0

205729

getCIDRPrefix("10.20.15.214", 16) returns "10.20.0.0" because a /16 mask zeroes out the last two octets. Adjust the prefix length to change granularity: use /24 for individual host subnets or /8 for broad network blocks. The prefix length must be between 0 and 32.

ipv4tonumber

Converts an IPv4 address from dot-decimal notation to its equivalent 32-bit unsigned decimal integer. This is useful for numeric range comparisons, sorting IPs arithmetically, and subnet boundary calculations without string manipulation.

Syntax

| ipv4tonumber(<ipv4String>) as <alias>
none

Parameters

Parameter Required Description

<ipv4String>

Yes

A string field or literal containing a dot-decimal IPv4 address.

as <alias>

Yes

Name for the numeric output column.

Example

Convert an IPv4 address to its 32-bit integer representation.

source="nginx"
| ipv4ToNumber("10.20.15.214") as ip_num
| min(ip_num) as min_ip, max(ip_num) as max_ip
Expected output
min_ip max_ip

169086934

169086934

The formula is: (octet1 × 16,777,216) + (octet2 × 65,536) + (octet3 × 256) + octet4. For example, 10.20.15.214 converts to 169,086,934. Use the numeric result with range comparisons to test subnet membership, or sort IPs in numerical order rather than lexicographically.

isprivateip

Checks whether an IPv4 address falls within a private (RFC 1918) address range. Returns true for addresses in the 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 ranges, and false for all other addresses. Use this operator to identify internal service-to-service traffic in your logs.

Syntax

| isprivateip(<ipv4String>) as <alias>
none

Parameters

Parameter Required Description

<ipv4String>

Yes

A string field or literal containing an IPv4 address.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether an nginx client IP falls within a private (RFC 1918) range.

source="nginx"
| isPrivateIP("10.20.15.214") as is_private
| count by is_private
Expected output
is_private _count

True

130532

isprivateip is the logical complement of ispublicip. In Kubernetes environments, most pod traffic originates from the 10.x.x.x private range, so most client IPs return true. Use is_private=False downstream to focus on external client traffic for security or geographic analysis.

ispublicip

Checks whether an IPv4 address is a public (routable) address. Returns false for addresses in RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and other reserved ranges, and true for all other addresses. Use this operator to identify external traffic in logs.

Syntax

| ispublicip(<ipv4String>) as <alias>
none

Parameters

Parameter Required Description

<ipv4String>

Yes

A string field or literal containing an IPv4 address.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether a specific IP address is public (routable on the internet).

source="nginx"
| isPublicIP("8.8.8.8") as is_public
| count by is_public
Expected output
is_public _count

True

124365

ispublicip returns false for RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and other reserved blocks. In Kubernetes environments, most client IPs in nginx access logs originate from the 10.x.x.x private range and return false. Use this operator to isolate external traffic for security auditing.

isvalidip

Checks whether an IPv4 or IPv6 address string is syntactically valid. Returns true if the address conforms to the correct format and falls within the allowed range, false otherwise. Useful for validating IP fields extracted from log lines before passing them to other IP operators.

Syntax

| isvalidip(<ipString>) as <alias>
none

Parameters

Parameter Required Description

<ipString>

Yes

A string field or literal containing an IPv4 or IPv6 address.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether an extracted IPv4 address is syntactically valid.

source="nginx"
| isValidIP("10.20.15.214") as valid_ip
| count by valid_ip
Expected output
valid_ip _count

True

133504

isvalidip validates format only — it does not check whether the address is routable or reachable. Use it to guard against malformed IP fields before passing them to ispublicip, isprivateip, or getcidrprefix. Addresses with extra content such as ports ("10.0.0.1:8080") return false.

maskfromcidr

Returns the IPv4 subnet mask string that corresponds to a given CIDR prefix length. The result is a dot-decimal string such as 255.255.255.0. Use this to display or compare subnet masks derived from CIDR notation.

Syntax

| maskfromcidr(<prefixLength>) as <alias>
none

Parameters

Parameter Required Description

<prefixLength>

Yes

An integer from 0 to 32 specifying the CIDR prefix length.

as <alias>

Yes

Name for the string output column.

Example

Compute the subnet mask for a /24 network and count log lines.

source="nginx"
| maskFromCIDR(24) as mask
| count
Expected output
_count

203641

Common results: maskFromCIDR(8) → "255.0.0.0", maskFromCIDR(16) → "255.255.0.0", maskFromCIDR(24) → "255.255.255.0", maskFromCIDR(32) → "255.255.255.255". The prefix length must be between 0 and 32 inclusive. Use maskfromcidr to display the human-readable mask alongside a CIDR-grouped IP report.