You can use
grok { match => { "url" => "/(?<[@metadata][uri]>[^/]*)$" } }
ruby {
code => '
uri = event.get("[@metadata][uri]")
if uri
event.set("[@metadata][json]", Base64.decode64(uri))
end
'
}
json { source => "[@metadata][json]" target => "[@metadata][stuff]" }
mutate { add_field => { "someField" => "%{[@metadata][stuff][key]}" } }
to process
"url" => "https://random-letters.cloudfront.net/eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ=="
and extract
"someField" => "path/to/your/image.jpg",