# Convert String to IP Address - Hexidecimal

**URL:** <https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192>\
**Category:** Logstash\
**Created:** [March 11, 2020, 6:29pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192 "2020-03-11T18:29:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jim\_Thunder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_thunder/32/45439_2.png) [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\
**Post date:** [March 11, 2020, 6:29pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192/1 "2020-03-11T18:29:38Z")

</div>

Hello!

I have fields that contain long Hexidecimal numbers `000000000FFFF24CA110B`

The prefix is the 0's and the four F's. So the only needed characters are the last 8 (2 for each octet of the IP address).

This number needs to be converted to an IP address but when I convert from Hex to Decimal, it doesn't recognize that there are 4 separate numbers in there, so I get a value of 2,###,###,### for each field.

How can I get around this without doing all kinds of splitting and re-merging functions?

I fear there's no easy way around it, but thought I would ask first.

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [March 12, 2020, 8:01am UTC](https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192/2 "2020-03-12T08:01:54Z")

</div>

Hi

If you could get a `grok{}` filter to parse your IP(hex) into four different fields, by forcing each two characters into a field using some regex magic, then you could place them into a dictionary, key-value style, and use a `ruby{}` filter to iterate through the dictionary and return the four fields in decimal, either as integer (`.to_i(16)` or `.hex`) or as string (`.to_s.hex`).

Hope this helps

---

<div class="post-metadata">

**Author:** ![Jim\_Thunder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_thunder/32/45439_2.png) [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\
**Post date:** [March 12, 2020, 5:49pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192/3 "2020-03-12T17:49:51Z")

</div>

That helped a lot. I was able to get exactly what I needed by using a grok filter to get the IP address hex characters separated and then a ruby filter for the rest. However, I was told that using a grok filter for everything else is far more efficient (except for the conversion from hex to decimal).

So with that said, do you have a suggestion on how I can use grok to parse the hex number into pairs?

For example: my first filter changes the number from `000000000FFFF24CA110B` to `24CA110B`. Now I need to split that number into pairs (each octet) using grok rather than ruby. Character pairs are at positions (0,1) - (2,3) - (4,5) - (6,7)

Any idea how I might accomplish that?

My first code piece is this:  
` grok { match => ["AP_TILIP", "00000000000000000000FFFF%{WORD:Local_IP_Hex}"] }`

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [March 13, 2020, 8:06am UTC](https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192/4 "2020-03-13T08:06:14Z")

</div>

Hi

Regex magic is not my forte. If you can post your `grok{}` filter maybe someone will be able to better assist you. I'll give it a shot as well.

Meanwhile, I did a quick google search and came up with something that might get you started:

```auto
...FFFF(?<OCTET1>[a-zA-Z0-9]{2}+)(?<OCTET2>[a-zA-Z0-9]{2}+)...

```

This should give you each pair in an `OCTETx` field.

---

<div class="post-metadata">

**Author:** ![Jim\_Thunder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_thunder/32/45439_2.png) [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\
**Post date:** [March 13, 2020, 6:26pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192/5 "2020-03-13T18:26:56Z")

</div>

Ah yes, that helps. I can do the rest from here. Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2020, 6:27pm UTC](https://discuss.elastic.co/t/convert-string-to-ip-address-hexidecimal/223192/6 "2020-04-10T18:27:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.