IP fields in Aggregations are sorted lexicographically instead of numerical

[janheise]

Expected Behavior

IP fields in Aggregations should be sorted numerically.

Current Behavior

IP fields are sorted lexicographically using the string representation.

Possible Solution

The problem is linked to the fact that we're using scripted terms in aggregations which leads to the treatment of the IP type as a a string. This can only be solved by a different approach. So there is no ETA yet.

Your Environment

• Graylog Version: 6.x
• Java Version:
• OpenSearch Version:
• MongoDB Version:
• Operating System:
• Browser version: