Mask presentation in Kibana

Elastic Stack Kibana
1

Hi,

I have a mac number which I present in Kibana after parsing in Logstash, and the value looks like that: 20%3A10%3A7a%3A53%3A0e%3A63

I would like to replace the "%" by ":" meaning the presentation in kibana to looks like: 20:3A10:3A7a:3A53:3A0e:3A63

Can it be done?

Thanks
Sharon.

2

Hi Sharon, it looks like that MAC address has been URL-encoded, in which case the value I think you really want is 20:10:7a:53:0e:63. Is this right? If so, you probably want to try using the Logstash Urldecode filter plugin.

Thanks,
CJ

3

Hi,

Reference wasn't clear to me. What should I actually do? And where?

Thanks
Sharon.

4

Hi Sharon, first let me just confirm that I understand what you're trying to do. You mentioned that your value is 20%3A10%3A7a%3A53%3A0e%3A63 and that you want to change it to 20:3A10:3A7a:3A53:3A0e:3A63. You referred to this value as a "mac number" (which I interpret as "MAC address"), and this original value also looks like it has been URL encoded. Because of this, I think you may be mistaken and I wonder if your intention is actually to convert the original value into 20:10:7a:53:0e:63, which is a valid MAC address represented by the original value, after it's been URL-decoded (you can verify this at the URL I just linked to).

Does this make sense? Am I correct in my interpretation of what you're trying to do?

If so, then I suggest incorporating the Urldecode filter plugin into your Logstash pipeline, since you mentioned you're using Logstash to parse your data. The filter plugin can be used to URL decode your original value into the correct MAC address value. Does this make sense? Are you familiar with Logstash filter plugins and how to add them to your pipeline?

Thanks,
CJ

1 Like
5

Hi Cj,

Yes, you are exactly correct.
I am not familiar with the filter plugins and how to add them.
Will try to learn from the docs.
If you can help me with short example it will be wonderful and also save time.
Thanks
Sharon.

6

solved. Thanks!!!

7

Fantastic! I'm glad you got it figured out!

Best,
CJ

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.