# Accurate decryption logstash data in Javascript

**URL:** https://discuss.elastic.co/t/accurate-decryption-logstash-data-in-javascript/341538
**Category:** Logstash
**Created:** [August 24, 2023, 5:38am UTC](https://discuss.elastic.co/t/accurate-decryption-logstash-data-in-javascript/341538 "2023-08-24T05:38:25Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Nik\_Ameer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik_ameer/32/124921_2.png) [@Nik\_Ameer](https://discuss.elastic.co/u/Nik_Ameer)
#### Post date: [August 24, 2023, 5:38am UTC](https://discuss.elastic.co/t/accurate-decryption-logstash-data-in-javascript/341538/1 "2023-08-24T05:38:25Z")

</div>

I used logstash to encrypt my data using the cipher filter.  
My logstash.conf file are like so

```auto
cipher {
            algorithm => "aes-256-cbc"
            cipher_padding => 1
            mode => "encrypt"
            source => <source _column_name>
            target => <target _column_name>
            iv_random_length => 16
            base64 => true
            max_cipher_reuse => 1
            key => MY_SECRET_KEY
            key_size => 32
        }

```

This is correct because my encrypted data looks like this in elasticsearch :  
`<target _column_name> : "+D0VukshqIG72XeOCwp8tCO3K4rqAhVjJ8fbOV4bzZY=",`

Now in my project I need to decrypt this in a react app, the solution I found was to use CryptoJS,  
here's my code:

```auto
import CryptoJS from "crypto-js";
.......
const decrypt = (encryptedText: any) => {

        const iv = CryptoJS.enc.Utf8.parse(encryptedText.slice(0, 16));
        const key = CryptoJS.enc.Utf8.parse(MY_SECRET_KEY);
        const ciphertext: any = CryptoJS.enc.Base64.parse(encryptedText); 
        const encryptedCP = CryptoJS.lib.CipherParams.create({
            ciphertext: ciphertext,
            formatter: CryptoJS.format.OpenSSL
        });

        try {
            const deciphered = CryptoJS.AES.decrypt(encryptedCP, key, { iv: iv, });
            const decryptedText = deciphered.toString(CryptoJS.enc.Latin1);
             
        } catch (err: any) {
            console.log(err)
        }
    };

```

What I don't understand is why does "decryptedText" always return my decrypted data with random characters:

```auto
"eÃM‚š¿bb›M˜Kä*t06"
"äÔ%<#lT¿=5eìCÒÛ06"
"Dì–Ò´4º¼ÑŸ†AlZ01"

```

My real data is at the end of the random characters, no matter what kind of data is encrypted, the decryption always return these random characters at the front.  
I want the decryption to be more accurate, meaning the decryption process completely removes the random chars, only the real data is left.

I hope anyone has find a way to solve this issue with CryptoJS, because I've been stuck at it for a while now.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 24, 2023, 2:02pm UTC](https://discuss.elastic.co/t/accurate-decryption-logstash-data-in-javascript/341538/2 "2023-08-24T14:02:11Z")

</div>

I think it is because your decrypted text has characters that cannot be encoded in Latin1, so the replacement character is used.

---

<div class="post-metadata">

### Author: ![Nik\_Ameer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik_ameer/32/124921_2.png) [@Nik\_Ameer](https://discuss.elastic.co/u/Nik_Ameer)
#### Post date: [August 25, 2023, 3:26am UTC](https://discuss.elastic.co/t/accurate-decryption-logstash-data-in-javascript/341538/3 "2023-08-25T03:26:16Z")

</div>

Thank your for your reply, previously I was encoding it into utf8 which gave me the error "Malformed UTF-8 data" everytime.  
Latin1 was the only one that gave me my actual data so that's why I'm opting for it, from what I read from stack overflow, random chars are because the IV is incorrect.  
I'm looking further into it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 22, 2023, 3:26am UTC](https://discuss.elastic.co/t/accurate-decryption-logstash-data-in-javascript/341538/4 "2023-09-22T03:26:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.