Hex Decode

Parse Data Analysis

Synopsis

Decodes hexadecimal strings to ASCII representation.

Schema

- hex_decode:
    field: <ident>
    target_field: <string>
    encoding: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Source field containing hexadecimal data to decode
target_field	N	Same as field	Target field to store decoded result
encoding	N	utf8	Character encoding: utf8, ascii, utf16le, utf16be
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if decoding fails
ignore_missing	N	false	Skip processing if referenced field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

Converts hexadecimal-encoded strings to their ASCII or Unicode text representation. The processor automatically handles common hex string formats including those with and without delimiters.

The processor supports various character encodings and can process both individual strings and arrays of hexadecimal strings.

note

The processor automatically removes common separators like spaces, colons, and hyphens from hexadecimal input. This allows processing of hex strings in various formats like "48:65:6C:6C:6F" or "48 65 6C 6C 6F".

The encoding parameter determines how the decoded bytes are interpreted as characters. UTF-8 is the default and handles most international characters.

warning

If the input contains invalid hexadecimal characters (anything other than 0-9, A-F, a-f), the processor will fail unless ignore_failure is set to true.

Examples

Basic Hex to ASCII

Converting hexadecimal to readable text...	{ "hex_data": "48656C6C6F20576F726C64" } - hex_decode: field: hex_data target_field: decoded_text
decodes to ASCII text:	{ "hex_data": "48656C6C6F20576F726C64", "decoded_text": "Hello World" }

Hex with Separators

Processing hex with colon separators...	{ "mac_address": "48:65:6C:6C:6F" } - hex_decode: field: mac_address target_field: decoded_value
automatically handles separators:	{ "mac_address": "48:65:6C:6C:6F", "decoded_value": "Hello" }

Array Processing

Decoding multiple hex strings...	{ "hex_array": [ "48656C6C6F", "576F726C64" ] } - hex_decode: field: hex_array target_field: decoded_array
processes each array element:	{ "hex_array": [...], "decoded_array": [ "Hello", "World" ] }

In-Place Decoding

Replacing hex field with decoded text...	{ "encoded_message": "44617461537472656616D" } - hex_decode: field: encoded_message
overwrites original field:	{ "encoded_message": "DataStream" }