Can Logstash Base64 decode then parse json from a cloudfront log?

Elastic Stack Logstash
2

You can use

    grok { match => { "url" => "/(?<[@metadata][uri]>[^/]*)$" } }
    ruby {
        code => '
            uri = event.get("[@metadata][uri]")
            if uri
                event.set("[@metadata][json]", Base64.decode64(uri))
            end
        '
    }
    json { source => "[@metadata][json]" target => "[@metadata][stuff]" }
    mutate { add_field => { "someField" => "%{[@metadata][stuff][key]}" } }

to process

       "url" => "https://random-letters.cloudfront.net/eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ=="

and extract

 "someField" => "path/to/your/image.jpg",