# XOR on field values

**URL:** https://discuss.elastic.co/t/xor-on-field-values/300346
**Category:** Beats
**Tags:** packetbeat
**Created:** [March 22, 2022, 1:27pm UTC](https://discuss.elastic.co/t/xor-on-field-values/300346 "2022-03-22T13:27:41Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![franpom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/franpom/32/117025_2.png) [@franpom](https://discuss.elastic.co/u/franpom)
#### Post date: [March 22, 2022, 1:27pm UTC](https://discuss.elastic.co/t/xor-on-field-values/300346/1 "2022-03-22T13:27:41Z")

</div>

Hello,  
Is it possible to use the XOR function in packetbeat processors or in Advanced / JSON input on field values?  
My goal is to do XOR on field values retrieved by packetbeat.

---

<div class="post-metadata">

### Author: ![franpom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/franpom/32/117025_2.png) [@franpom](https://discuss.elastic.co/u/franpom)
#### Post date: [March 28, 2022, 1:23pm UTC](https://discuss.elastic.co/t/xor-on-field-values/300346/2 "2022-03-28T13:23:25Z")

</div>

Hello

I find

```auto
POST /_scripts/painless/_execute
{
  "script": {
    "lang": "painless",
    "source": """
      def hr1 = params.hexa.substring(8,16);
      def hm1 = params.hexa.substring(24,32);
      def r1 = Long.valueOf(hr1, 16);
      def m1 = Long.valueOf(hm1, 16);
      def v1 = r1 ^ m1;
      hr1+'='+r1+' '+hm1+'='+m1+' '+v1
    """,
    "params": {
      "hexa": "60f574e53d2d1b91740d129b86789ec2cf5897c8d1cb6bd"
    }
  }
}

```

Result

```auto
{
  "result" : "3d2d1b91=1026366353 86789ec2=2256051906 3142944083"
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2022, 3:24pm UTC](https://discuss.elastic.co/t/xor-on-field-values/300346/3 "2022-04-25T15:24:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
