Hi Sharon, first let me just confirm that I understand what you're trying to do. You mentioned that your value is
20%3A10%3A7a%3A53%3A0e%3A63 and that you want to change it to
20:3A10:3A7a:3A53:3A0e:3A63. You referred to this value as a "mac number" (which I interpret as "MAC address"), and this original value also looks like it has been URL encoded. Because of this, I think you may be mistaken and I wonder if your intention is actually to convert the original value into
20:10:7a:53:0e:63, which is a valid MAC address represented by the original value, after it's been URL-decoded (you can verify this at the URL I just linked to).
Does this make sense? Am I correct in my interpretation of what you're trying to do?
If so, then I suggest incorporating the Urldecode filter plugin into your Logstash pipeline, since you mentioned you're using Logstash to parse your data. The filter plugin can be used to URL decode your original value into the correct MAC address value. Does this make sense? Are you familiar with Logstash filter plugins and how to add them to your pipeline?