# Grok Pattern to add missing characters to a mac address

**URL:** <https://discuss.elastic.co/t/grok-pattern-to-add-missing-characters-to-a-mac-address/140865>\
**Category:** Logstash\
**Created:** [July 20, 2018, 9:57am UTC](https://discuss.elastic.co/t/grok-pattern-to-add-missing-characters-to-a-mac-address/140865 "2018-07-20T09:57:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![martinrw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martinrw/32/39571_2.png) [@martinrw](https://discuss.elastic.co/u/martinrw)\
**Post date:** [July 20, 2018, 9:57am UTC](https://discuss.elastic.co/t/grok-pattern-to-add-missing-characters-to-a-mac-address/140865/1 "2018-07-20T09:57:41Z")

</div>

Hi

I'm attempting to use grok patterns in my logstash config to tokenise output from dhcpd.  
I have successfully managed it apart form one bit... DHCPD sometimes removes leading 0's from Mac addresses, specifically on the COMMIT messages

The log line we get looks like this:

```
"Jul 20 09:51:45 dhcp-server dhcpd[19674]: DHCPCOMMIT: IP: 100.101.102.103 MAC: 0:f:84:5a:f0:e0 Option82: 172.16.16.16 eth 000021/024:0100 LT: 3600"

```

my grok pattern looks like this

```
        grok {
      match => ["syslog_message", "(?<dhcp_action>.*): IP: %{IP:dhcp_ip}.* MAC: %{NOTSPACE:dhcp_mac_address}.* Option82: %{GREEDYDATA:dhcp_option_82_data}.* LT: %{INT:dhcp_lt}"]
    }

```

which means I now have a field called dhcp\_mac\_address with the value "0:f:94:54:f0:e0"

What can I do here to change that to "00:0f:94:54:f0:e0"

The general pattern is that for each section of the mac address, if there is only one character then put a 0 in front of it.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 20, 2018, 2:30pm UTC](https://discuss.elastic.co/t/grok-pattern-to-add-missing-characters-to-a-mac-address/140865/2 "2018-07-20T14:30:23Z")

</div>

> [@martinrw](#):
>
> "0:f:94:54:f0:e0"

There has to be a better way, but this will do it.

```
    ruby {  
        code => '
            s = ""
            a = event.get("dhcp_mac_address").split(":").each { |x|
                s += sprintf("%02x", x.to_i(16)) + ":"
            }
            event.set("dhcp_mac_address2", s[0..-2])
        '
    }

```

---

<div class="post-metadata">

**Author:** ![martinrw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martinrw/32/39571_2.png) [@martinrw](https://discuss.elastic.co/u/martinrw)\
**Post date:** [July 20, 2018, 4:22pm UTC](https://discuss.elastic.co/t/grok-pattern-to-add-missing-characters-to-a-mac-address/140865/3 "2018-07-20T16:22:33Z")

</div>

Thanks Badger, that worked.

I may also investigate fixing the issue at source - [https://kb.isc.org/article/AA-01039/0/Formatting-MAC-addresses-in-dhcpd-or-why-does-binary-to-ascii-strip-leading-zeroes.html](https://kb.isc.org/article/AA-01039/0/Formatting-MAC-addresses-in-dhcpd-or-why-does-binary-to-ascii-strip-leading-zeroes.html)  
but until then this seem alright.

Cheers

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2018, 4:22pm UTC](https://discuss.elastic.co/t/grok-pattern-to-add-missing-characters-to-a-mac-address/140865/4 "2018-08-17T16:22:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.