Hi Sharon, it looks like that MAC address has been URL-encoded, in which case the value I think you really want is 20:10:7a:53:0e:63. Is this right? If so, you probably want to try using the Logstash Urldecode filter plugin.
Hi Sharon, first let me just confirm that I understand what you're trying to do. You mentioned that your value is 20%3A10%3A7a%3A53%3A0e%3A63 and that you want to change it to 20:3A10:3A7a:3A53:3A0e:3A63. You referred to this value as a "mac number" (which I interpret as "MAC address"), and this original value also looks like it has been URL encoded. Because of this, I think you may be mistaken and I wonder if your intention is actually to convert the original value into 20:10:7a:53:0e:63, which is a valid MAC address represented by the original value, after it's been URL-decoded (you can verify this at the URL I just linked to).
Does this make sense? Am I correct in my interpretation of what you're trying to do?
If so, then I suggest incorporating the Urldecode filter plugin into your Logstash pipeline, since you mentioned you're using Logstash to parse your data. The filter plugin can be used to URL decode your original value into the correct MAC address value. Does this make sense? Are you familiar with Logstash filter plugins and how to add them to your pipeline?
Yes, you are exactly correct.
I am not familiar with the filter plugins and how to add them.
Will try to learn from the docs.
If you can help me with short example it will be wonderful and also save time.
Thanks
Sharon.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.