# Can Logstash Base64 decode then parse json from a cloudfront log?
**URL:** https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367
**Category:** Logstash
**Created:** [August 3, 2021, 9:58pm UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367 "2021-08-03T21:58:17Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@chrisan](https://discuss.elastic.co/u/chrisan)
#### Post date: [August 3, 2021, 9:58pm UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367/1 "2021-08-03T21:58:17Z")
Hello, we are using AWS's image resizer [Serverless Image Handler | Implementations | AWS Solutions](https://aws.amazon.com/solutions/implementations/serverless-image-handler/)
To get an image, you need to base64 encode a json object such as
`{"bucket":"my-s3-bucket","key":"path/to/your/image.jpg","edits":{"resize":{"width":200,"fit":"cover"}}}`
which becomes `eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ==`
So you would end up with a url of [https://random-letters.cloudfront.net/eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ==](https://random-letters.cloudfront.net/eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ==) This url is what ends up in the cloudfront logs that are delivered to the s3 bucket.
What I'd like to do is have Logstash grab these cloudfront logs, decode url, and grab the "real" url `path/to/your/image.jpg` for Elasticsearch
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 3, 2021, 10:53pm UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367/2 "2021-08-03T22:53:49Z")
You can use
```
grok { match => { "url" => "/(?<[@metadata][uri]>[^/]*)$" } }
ruby {
code => '
uri = event.get("[@metadata][uri]")
if uri
event.set("[@metadata][json]", Base64.decode64(uri))
end
'
}
json { source => "[@metadata][json]" target => "[@metadata][stuff]" }
mutate { add_field => { "someField" => "%{[@metadata][stuff][key]}" } }
```
to process
```
"url" => "https://random-letters.cloudfront.net/eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ=="
```
and extract
```
"someField" => "path/to/your/image.jpg",
```
---
### Author:  [@chrisan](https://discuss.elastic.co/u/chrisan)
#### Post date: [August 5, 2021, 9:06am UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367/3 "2021-08-05T09:06:05Z")
thank you, worked great!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2021, 9:06am UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367/4 "2021-09-02T09:06:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.