# Logstash-filter-bitflags - a filter plugin for converting bitfields to a map of flag:bool pairs

**URL:** <https://discuss.elastic.co/t/logstash-filter-bitflags-a-filter-plugin-for-converting-bitfields-to-a-map-of-flag-bool-pairs/34863>\
**Category:** Community Ecosystem\
**Created:** [November 17, 2015, 11:20pm UTC](https://discuss.elastic.co/t/logstash-filter-bitflags-a-filter-plugin-for-converting-bitfields-to-a-map-of-flag-bool-pairs/34863 "2015-11-17T23:20:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![edx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edx/32/5988_2.png) [@edx](https://discuss.elastic.co/u/edx)\
**Post date:** [November 17, 2015, 11:20pm UTC](https://discuss.elastic.co/t/logstash-filter-bitflags-a-filter-plugin-for-converting-bitfields-to-a-map-of-flag-bool-pairs/34863/1 "2015-11-17T23:20:09Z")

</div>

I humbly submit my first plugin, which is also my first "project" in Ruby. Please go easy on me 😄

> **[crashish/logstash-filter-bitflags](https://github.com/crashish/logstash-filter-bitflags)**
>
> logstash-filter-bitflags - a logstash filter plugin for translating bitfields to boolean flags

I wrote this plugin because our data model includes a bitfield and there have been no other options to do this within the existing ELK pipeline (as far as I know). When configured with a map of flags to bit values, this will convert an integer representing the source bitfield to a map of flag and boolean value pairs.

Example

@trans from config:  
-- { "trans1" =\>1, "trans2" =\>2, "trans3" =\>4, "trans4" =\>8, "trans5" =\>12, "trans6" =\> 16, "trans7" =\>32, "trans8" =\>64, "trans9" =\>128 }

@source integer:  
-- { "flag\_source": 191 }

this should translate to  
-- event[@target] = {"trans7"=\>true, "trans8"=\>false, "trans9"=\>true, "trans1"=\>true, "trans2"=\>true, "trans3"=\>true, "trans4"=\>true, "trans5"=\>true, "trans6"=\>true}

Please let me know if you find this useful, or if you find it broken, or if you have any other comments or questions. I can frequently be found in the freenode IRC channels going by the nick 'edx'.

-Ed

---

<div class="post-metadata">

**Author:** ![voipoclay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/voipoclay/32/4372_2.png) [@voipoclay](https://discuss.elastic.co/u/voipoclay)\
**Post date:** [November 21, 2015, 5:59am UTC](https://discuss.elastic.co/t/logstash-filter-bitflags-a-filter-plugin-for-converting-bitfields-to-a-map-of-flag-bool-pairs/34863/2 "2015-11-21T05:59:03Z")

</div>

I think this is cool. I usually convert my bit wise to array like 129 would be [1,128] which I use for my bool queries.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:48pm UTC](https://discuss.elastic.co/t/logstash-filter-bitflags-a-filter-plugin-for-converting-bitfields-to-a-map-of-flag-bool-pairs/34863/3 "2017-07-05T21:48:06Z")

</div>

Closed on July 5, 2017, 9:48pm UTC