Sorry for the 4 year resurrection of the thread,  but I was wondering if this lead anywhere.   Working with lookups for assets and identities in ES and finding issues with the use / inconsistancies with the way 'make_ip_cidr' operates.    For ES population,  I'm trying to use MV in KV stores of assets,  as well as delimited csv lookups -  but the cidr matching,  make_ip_cidr and expandiprange  and the lack of support of /32 is causing issues.  ... View more