OR query

gistfile1.txt

PUT /test
POST /test/doc/_mapping
{
   "properties": {
      "message": {
         "fielddata": {
            "format": "disabled"
         },
         "index": "analyzed",
         "omit_norms": true,
         "type": "string"
      }
   }
}

PUT /test/doc/1
{
    "message" : "foo bar 123.456.254.25 foo bar"
}
PUT /test/doc/2
{
    "message" : "foo bar 456.789.242.195 foo bar"
}
PUT /test/doc/3
{
    "message" : "foo bar 234.456.242.195 foo bar"
}

POST /test/_search
{
    "query": {
        "match": {
            "message": {
                "operator": "or",
                "query": "123.456.254.25 456.789.242.195 234.456.242.195"
            }
        }
    }
}