# Can Logstash Base64 decode then parse json from a cloudfront log?

**URL:** https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367
**Category:** Logstash
**Created:** [August 3, 2021, 9:58pm UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367 "2021-08-03T21:58:17Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 3, 2021, 10:53pm UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367/2 "2021-08-03T22:53:49Z")

</div>

You can use

```
    grok { match => { "url" => "/(?<[@metadata][uri]>[^/]*)$" } }
    ruby {
        code => '
            uri = event.get("[@metadata][uri]")
            if uri
                event.set("[@metadata][json]", Base64.decode64(uri))
            end
        '
    }
    json { source => "[@metadata][json]" target => "[@metadata][stuff]" }
    mutate { add_field => { "someField" => "%{[@metadata][stuff][key]}" } }

```

to process

```
       "url" => "https://random-letters.cloudfront.net/eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ=="

```

and extract

```
 "someField" => "path/to/your/image.jpg",
```

---

_[View the full topic](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367)._