Grok pattern matching from MAC access

[mussa572 (Musa)]

Hi

wondering if some one can help . We are ingesting some of the Linux Inventory in Elastic Search . One of the field is MAC address (00:50:56:a9:2c:51) .

We are looking for the if condition where if 4 charter of MAC address are 00:50 then we want to add the new field with Hardware = Virtual .

is there a way extract the value to using regex in Logstash .

regards

[magnusbaeck (Magnus Bäck)]

if [name-of-field] =~ /^00:50:/ {
  mutate {
    add_field => {
      "Hardware" => "Virtual"
    }
  }
}