Using Ruby Code in Logstash for Translating Text from HEX

In Elasticsearch pipelines, you might encounter scenarios where fields contain hexadecimal-encoded text. To decode this text into its original readable format, Logstash offers the ability to use Ruby code within the pipeline configuration. This article demonstrates how to achieve this transformation.

Why Use Ruby for HEX Decoding?
Hexadecimal-encoded text often represents binary data or strings in a compact and structured format. Decoding this text is crucial for making the data human-readable and ready for downstream processing in Elasticsearch or visualization in Kibana.

Ruby Filter for HEX Decoding
Below is an example of a Ruby filter in Logstash that decodes a field containing HEX-encoded text:

ruby {
  code => "
    event.set('Your_field_HEX', event.get('Your_field_HEX').split.pack('H*'))
  "
}

1. event.get('Your_field_HEX'): Retrieves the value of the HEX-encoded field (Your_field_HEX) from the event.
2. .split: Splits the string into an array of hexadecimal characters.
3. .pack('H*'): Converts the HEX characters into their original binary form or readable string format.
4. event.set('Your_field_HEX', ...): Updates the field with its decoded value.

input {
  beats {
    port => 5044
  }
}

filter {
  if [type] == "example_type" {
    ruby {
      code => "
        event.set('decoded_field', event.get('Your_field_HEX').split.pack('H*'))
      "
    }
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "decoded-hex-data"
  }
}

Steps:

• Replace Your_field_HEX with the name of the field containing the HEX data.
• Add the ruby filter inside the filter section of your pipeline.
• Deploy the pipeline in Logstash.