# A short question of GROK to handle hex number **URL:** \ **Category:** Logstash\ **Created:** [July 12, 2018, 7:01am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684 "2018-07-12T07:01:31Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\ **Post date:** [July 12, 2018, 7:01am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/1 "2018-07-12T07:01:31Z")
Hello every experts, I have met a short question. Here is a source input content, it is one function back trace of an issue, the content shows as below: `101c2f8f 1106f017 129570e2 1210da9a 1290fa12 10fb825d120e33ed 120e188f 1058b38c` As we known, the function back trace are constiuted by several hexadecimal number group, every group should be included 8 hex numbers. but some of them are missing one space that result 16 hex numbers are in one group. I use GROK plugin to add a field which named "fcn", such liks this: ``` grok { match => { "message" => [ (?((\h){8}\s*)*) ] } } ``` then the output shows as below: ``` { "fcn": [ [ "101c2f8f 1106f017 129570e2 1210da9a 1290fa12 10fb825d120e33ed 120e188f 1058b38c" ] ] } ``` My expect output want to be: ``` [ "101c2f8f 1106f017 129570e2 1210da9a 1290fa12 10fb825d 120e33ed 120e188f 1058b38c" ] ``` how should I do that can split them as every 8 hex numbers constitued one hex group? Thank you. ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [July 12, 2018, 9:32am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/2 "2018-07-12T09:32:13Z")
Judging by your example, you actually need to insert characters at some point in the string and otherwise capture the field as-is. That would be hard or messy to do with grok + some other method. The best option I think would be some custom Ruby code, e.g. ```auto filter { ruby { code => " # remove whitespace -> split every 8 chars -> join by whitespace event.set('fcn', event.get('message').delete(' ').scan(/.{8}/).join(' ')) " } } ``` ---
**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\ **Post date:** [July 13, 2018, 1:34am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/3 "2018-07-13T01:34:04Z")
Mermigkas, Thanks a lot for your help, which make me understand to use ruby code to realize my object. But actually my input message include a lot of other information, such as process name, service name and so on, there are included a lot of useful space. which shows as below: `{process:sbl.elf (35),service:tafe,output:{Function Trace:101c2f8f 1106f017 129570e2 1210da9a 1290fa12 10fb825d120e33ed 120e188f 1058b38c f67dab28}}` If I use your code that may impact other format of infomration. are there some better methods to handle it? Thanks again! ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [July 13, 2018, 8:04am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/4 "2018-07-13T08:04:43Z")
You can use any other method to extract the fields, like grok, which will result in a malformed _fcn_ field. Then use the above Ruby code on that field to fix it's format. ---
**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\ **Post date:** [July 17, 2018, 6:57am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/5 "2018-07-17T06:57:10Z")
Hi Mermigkas, I want to use your ruby code to handle my log event, but I want only handle the function trace part, and firstly I have parsed the message by grok plugin: The sub pattern shows as below: `"process:%{GREEDYDATA:process}\s*service:%{WORD:service},output:{Function Trace:%{GREEDYDATA:fcn}}"` How can I use your ruby code to only handle the fcn part? Thank you. ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [July 17, 2018, 7:14am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/6 "2018-07-17T07:14:11Z")
Just paste the Ruby code block after the grok part in your filters. It should work as-is. ---
**Author:** ![terrymu](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@terrymu](https://discuss.elastic.co/u/terrymu)\ **Post date:** [July 17, 2018, 7:33am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/7 "2018-07-17T07:33:25Z")
Hi Mermigkas, How can I only get the fcn part from message in ruby code? can you make a example? because in the below code you will get all the message content, delete the space will impact other parts. `event.set('parsed_fcn', event.get('message').delete(' ').scan(/.{8}/).join(' '))` ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [July 17, 2018, 7:35am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/8 "2018-07-17T07:35:11Z")
Ah, you are correct. Use ```auto filter { ruby { code => " event.set('parsed_fcn', event.get('fcn').delete(' ').scan(/.{8}/).join(' ')) " } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 14, 2018, 7:35am UTC](https://discuss.elastic.co/t/a-short-question-of-grok-to-handle-hex-number/139684/9 "2018-08-14T07:35:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.