Hexadecimal to Decimal

Elastic Stack Logstash
1

Hi, I am trying to convert a field in my log from hexadecimal to decimal.

I tried with the following log:

2021-07-26T16:49:02.189807+0200 | DEBUG | 910EAB70 | flyscan/core/server.1 | ScanActorTask::handle_message

Using the following code I try changing the hexa field I called process thread id to decimal:

    mutate {
        convert => { "[process][thread][id]" => "integer" }
       }
    
    ruby {
        code => "event.set('[process][thread][id]', event.get('[process][thread][id]').to_s.hex)"
      }

910EAB70 was transformed to 2320 in Elasticsearch (which is 910 in hexadecimal) knowing that the right answer is 2433657712.

I tried for another log:
2021-07-26T16:49:02.185140+0200 | DEBUG | AF788B70 | flyscan/core/server.1 | FlyscanTask::handle_message LOAD_CONFIG

AF788B70 herewas transformed to 0 in Elasticsearch knowing that the right answer is 2943912816.

What am I missing? Thanks in advance.

2

convert calls .to_i on the string, which by default works in base 10, and "Returns the integer value of leading characters, interpreted as an integer". If you want to parse it as hex you will have to do that in the ruby filter.

3 
    ruby {
        code => '
            hexNum = event.get("[process][thread][id]")
            event.set("decNum", hexNum.to_i(16).to_s(10))
        '
    }
    ruby {
        code => "event.set('[process][thread][id]', event.get('[process][thread][id]').to_s.hex)"
      }

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.