To Hex

Convert

Synopsis

Converts an integer field to its lowercase hexadecimal string representation.

Schema

- to_hex:
    field: <ident>
    min_digits: <numeric>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field containing the integer to convert
min_digits	N	0	Pad the result with leading zeros to at least this many digits. Values above 16 are clamped to 16
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
target_field	N	field	Field to store the hexadecimal string. Defaults to field, replacing the number

Details

The output is a string, lowercase, with no 0x prefix. Add one with a Set or Append step if the downstream system expects it.

A negative number is rendered as its 64-bit two's-complement pattern, so -1 becomes ffffffffffffffff rather than -1. This is the representation a bitmask or flags field is usually wanted in; it is not an error, and it is why the padding cap is 16 — that is the width of a 64-bit value in hexadecimal.

min_digits only ever adds zeros. A value already longer than min_digits is left at its natural width rather than being truncated.

Examples

Basic Conversion

Converting an event ID to hexadecimal...	{ "event": {"code": 4624} } - to_hex: field: event.code target_field: event.code_hex
as a lowercase string with no prefix:	{ "event": { "code": 4624, "code_hex": "1210" } }

Fixed Width

Padding to a fixed width so values sort and align...	{ "status": 255 } - to_hex: field: status min_digits: 8 target_field: status_hex
with leading zeros added to reach the width:	{ "status": 255, "status_hex": "000000ff" }

Negative Values

A negative number renders as its 64-bit bit pattern...	{ "mask": -1 } - to_hex: field: mask target_field: mask_hex
which is the form a flags field is read in:	{ "mask": -1, "mask_hex": "ffffffffffffffff" }