# Converting field with HEX value to ASCII

**URL:** <https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878>\
**Category:** Logstash\
**Created:** [September 23, 2015, 10:33pm UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878 "2015-09-23T22:33:58Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![gcaccia](https://avatars.discourse-cdn.com/v4/letter/g/d07c76/32.png) [@gcaccia](https://discuss.elastic.co/u/gcaccia)\
**Post date:** [September 23, 2015, 10:33pm UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/1 "2015-09-23T22:33:58Z")

</div>

I have a dump file of JSON documents where many of the fields are in HEX. I want to import this into Elasticsearch using Logstash. Can Logstash convert HEX fields to ASCII?

Thanks,

Glenn

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 23, 2015, 10:55pm UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/2 "2015-09-23T22:55:09Z")

</div>

Not by itself, no.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 24, 2015, 3:44am UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/3 "2015-09-24T03:44:11Z")

</div>

There's no built-in filter for this but it should be easy to do with a ruby filter and some custom Ruby code.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 24, 2015, 3:52am UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/4 "2015-09-24T03:52:15Z")

</div>

Or if you built a filter it'd be an awesome community resource 🙂

---

<div class="post-metadata">

**Author:** ![jonathanpmartins](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jonathanpmartins](https://discuss.elastic.co/u/jonathanpmartins)\
**Post date:** [June 1, 2016, 10:19am UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/5 "2016-06-01T10:19:44Z")

</div>

Does it exists yet? Help me out, Im will make this plugin! How can I begin?

---

<div class="post-metadata">

**Author:** ![jonathanpmartins](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jonathanpmartins](https://discuss.elastic.co/u/jonathanpmartins)\
**Post date:** [June 1, 2016, 10:23am UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/6 "2016-06-01T10:23:01Z")

</div>

Forget it, I found IT: [https://www.elastic.co/guide/en/logstash/current/\_how\_to\_write\_a\_logstash\_input\_plugin.html](https://www.elastic.co/guide/en/logstash/current/_how_to_write_a_logstash_input_plugin.html)

---

<div class="post-metadata">

**Author:** ![ghawk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghawk/32/14314_2.png) [@ghawk](https://discuss.elastic.co/u/ghawk)\
**Post date:** [January 4, 2017, 7:25pm UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/7 "2017-01-04T19:25:28Z")

</div>

I found a simple way if you are just doing double quotes. the trick is using single quotes around the double quote for replace

mutate {  
gsub =\> ["request", "\x22", '"']  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878/8 "2017-07-06T04:29:34Z")

</div>