Fiddling with the facet APi tonight. Found that a facet term query on a field that is an IP address ends up coming back with the 'term' as a string number, not the actual IP address in dotted notation.

My query:

'{"size":1, "query": { "query_string": { "query": "clientip:*" } }, "facets": { "foo": { "terms": { "field": "clientip", "size": 4 } } } }

Results:
{
...
"_source" : {..., clientip":["76.21.79.138"] ... }
...
"facets" : {
"foo" : {
"_type" : "terms",
"_field" : "clientip",
"terms" : [ {
"term" : "1136881900",
"count" : 12375
}, {
"term" : "3497226231",
"count" : 4223
}, {
"term" : "1123633115",
"count" : 3215
}, {
"term" : "1600953340",
"count" : 2312
} ]
}
}
}