format field at search time (phone, ip, MAC, etc..)

[mataharry]

I want to format nicely the fields or events at search time.

by example :
US phone : 11122223333 to (111) 222-3333
ipv4 : 1-2-3-4 to 1.2.3.4
credit card : 43431111222233334444 to 4343-1111-2222-3333-4444

[yannK · Accepted solution]

You can use the rex command on any field, define macros.
If needed you can also use the SEDCMD to format the events at index time (but this will be definitive)

please replace the field by the one needed, and update the regex based on your needs.

mysearch | eval phone=1112223333 | rex field=phone mode=sed "s/(\d{3})(\d{3})(\d{4})/(\1) \2-\3/g" | table phone

mysearch | eval ip="1-2-133-4" | rex field=ip mode=sed "s/(\d{1,3})-(\d{1,3})-(\d{1,3})-(\d{1,3})/\1.\2.\3.\4/g" | table ip

it can be improved, ip block should be <= 255

mysearch | eval card="43431111222233334444" | rex field=card mode=sed "s/(43\d{2})(\d{4})(\d{4})(\d{4})(\d{4})/\1-\2-\3-\4-\5/g" | table card

this one will only match credit cards starting with 43.