Convert String to IP Address - Hexidecimal

Elastic Stack Logstash
1

Hello!

I have fields that contain long Hexidecimal numbers 000000000FFFF24CA110B

The prefix is the 0's and the four F's. So the only needed characters are the last 8 (2 for each octet of the IP address).

This number needs to be converted to an IP address but when I convert from Hex to Decimal, it doesn't recognize that there are 4 separate numbers in there, so I get a value of 2,###,###,### for each field.

How can I get around this without doing all kinds of splitting and re-merging functions?

I fear there's no easy way around it, but thought I would ask first.

2

Hi

If you could get a grok{} filter to parse your IP(hex) into four different fields, by forcing each two characters into a field using some regex magic, then you could place them into a dictionary, key-value style, and use a ruby{} filter to iterate through the dictionary and return the four fields in decimal, either as integer (.to_i(16) or .hex) or as string (.to_s.hex).

Hope this helps

1 Like
3

That helped a lot. I was able to get exactly what I needed by using a grok filter to get the IP address hex characters separated and then a ruby filter for the rest. However, I was told that using a grok filter for everything else is far more efficient (except for the conversion from hex to decimal).

So with that said, do you have a suggestion on how I can use grok to parse the hex number into pairs?

For example: my first filter changes the number from 000000000FFFF24CA110B to 24CA110B. Now I need to split that number into pairs (each octet) using grok rather than ruby. Character pairs are at positions (0,1) - (2,3) - (4,5) - (6,7)

Any idea how I might accomplish that?

My first code piece is this:
grok { match => ["AP_TILIP", "00000000000000000000FFFF%{WORD:Local_IP_Hex}"] }

4

Hi

Regex magic is not my forte. If you can post your grok{} filter maybe someone will be able to better assist you. I'll give it a shot as well.

Meanwhile, I did a quick google search and came up with something that might get you started:

...FFFF(?<OCTET1>[a-zA-Z0-9]{2}+)(?<OCTET2>[a-zA-Z0-9]{2}+)...

This should give you each pair in an OCTETx field.

5

Ah yes, that helps. I can do the rest from here. Thank you so much!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.