I tried to create an example for you. What I’m using is Graylog 4.0.
Created a new field using a Regular expression from what information you gave us as shown below,
First I used this site for testing my Regular expression → here.
Then I created the extrator.
Using a pipeline to convert the your_new_field to a different value.
has_field("your_new_field") AND contains(to_string($message.your_new_field), "0x10000")
Still fairly new at using pipelines and Regular expression. This worked for me to converting numbers into a name. I have seen other members/staff here work with pipelines better then i can.
Hope this helps