# Wrong format of MAC address using SNMPTRAP input

**URL:** https://discuss.elastic.co/t/wrong-format-of-mac-address-using-snmptrap-input/167836
**Category:** Logstash
**Created:** [February 11, 2019, 11:44am UTC](https://discuss.elastic.co/t/wrong-format-of-mac-address-using-snmptrap-input/167836 "2019-02-11T11:44:38Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rudok](https://avatars.discourse-cdn.com/v4/letter/r/f17d59/32.png) [@rudok](https://discuss.elastic.co/u/rudok)
#### Post date: [February 11, 2019, 11:44am UTC](https://discuss.elastic.co/t/wrong-format-of-mac-address-using-snmptrap-input/167836/1 "2019-02-11T11:44:39Z")

</div>

Our Logstash output contains "invalid" characters on field containing mac address. Is there any filter how to covert it to readable format?

Thx

logstash output:

{  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyFromPortId.0" =\> "10",  
"message" =\> "#\<SNMP::SNMPv1\_Trap:0x2139c25e @enterprise=[1.3.6.1.4.1.11.2.14.11.5.1.66], @timestamp=#\<SNMP::TimeTicks:0x26f158d3 @value=26775567\>, @varbind\_list=[#\<SNMP::VarBind:0x1bfe0042 @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.6.0], @value=#\<SNMP::Integer:0x74ba0a51 @value=3\>\>, #\<SNMP::VarBind:0x58a1e3d5 @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.7.0], @value="\x00\x13;\x9Bb\x96"\>, #\<SNMP::VarBind:0x2fb5bbbb @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.8.0], @value=#\<SNMP::Integer:0x4422521f @value=10\>\>, #\<SNMP::VarBind:0x60ee3048 @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.9.0], @value=#\<SNMP::Integer:0x3786c8cb @value=0\>\>, #\<SNMP::VarBind:0x356cd5e3 @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.10.0], @value=#\<SNMP::Integer:0x6388cbfb @value=7\>\>], @specific\_trap=1, @source\_ip="172.20.7.20", @agent\_addr=#\<SNMP::IpAddress:0x72f5dbb2 @value="\xAC\x14\a\x14"\>, @generic\_trap=6\>",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyToPortId.0" =\> "0",  
"host" =\> "172.20.7.20",  
"@timestamp" =\> 2019-02-11T11:43:02.979Z,  
"@version" =\> "1",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyMacAddress.0" =\> "\x00\x13;\x9Bb\x96",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyAction.0" =\> "3",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyVlanId.0" =\> "7"  
}

---

<div class="post-metadata">

### Author: ![rudok](https://avatars.discourse-cdn.com/v4/letter/r/f17d59/32.png) [@rudok](https://discuss.elastic.co/u/rudok)
#### Post date: [February 11, 2019, 12:53pm UTC](https://discuss.elastic.co/t/wrong-format-of-mac-address-using-snmptrap-input/167836/2 "2019-02-11T12:53:12Z")

</div>

Ok,

I tried to solve my problem using bperian [https://github.com/logstash-plugins/logstash-input-snmptrap/pull/25/files](https://github.com/logstash-plugins/logstash-input-snmptrap/pull/25/files) ( I edited snmptrap.rb)

output looks OK, we will test this solution.  
Thx

Actual output:

{  
"@version" =\> "1",  
"message" =\> "#\<SNMP::SNMPv1\_Trap:0x26ec1eb2 @enterprise=[1.3.6.1.4.1.11.2.14.11.5.1.66], @timestamp=#\<SNMP::TimeTicks:0xbef160a @value=27162568\>, @varbind\_list=[#\<SNMP::VarBind:0x37c0a3c2 @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.6.0], @value=#\<SNMP::Integer:0x719f3206 @value=3\>\>, #\<SNMP::VarBind:0x2332579 @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.7.0], @value="\x00\x13;\x9Bb\x96"\>, #\<SNMP::VarBind:0x2be6ca17 @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.8.0], @value=#\<SNMP::Integer:0x190ab21a @value=10\>\>, #\<SNMP::VarBind:0x118dac3f @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.9.0], @value=#\<SNMP::Integer:0xa8e5b9a @value=0\>\>, #\<SNMP::VarBind:0x17a59eae @name=[1.3.6.1.4.1.11.2.14.11.5.1.66.1.10.0], @value=#\<SNMP::Integer:0x5bf37422 @value=7\>\>], @specific\_trap=1, @source\_ip="172.20.7.20", @agent\_addr=#\<SNMP::IpAddress:0x2763c737 @value="\xAC\x14\a\x14"\>, @generic\_trap=6\>",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyFromPortId.0" =\> "10",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyAction.0" =\> "3",  
"@timestamp" =\> 2019-02-11T12:47:33.008Z,  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyMacAddress.0" =\> "00:13:3b:9b:62:96",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyToPortId.0" =\> "0",  
"HP-ICF-MACNOTIFY-MIB::hpicfMacNotifyVlanId.0" =\> "7",  
"host" =\> "172.20.7.20"  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 11, 2019, 12:53pm UTC](https://discuss.elastic.co/t/wrong-format-of-mac-address-using-snmptrap-input/167836/3 "2019-03-11T12:53:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.