# Decode and Add derived/custom fields

**URL:** <https://discuss.elastic.co/t/decode-and-add-derived-custom-fields/237175>\
**Category:** Logstash\
**Created:** [June 15, 2020, 5:52pm UTC](https://discuss.elastic.co/t/decode-and-add-derived-custom-fields/237175 "2020-06-15T17:52:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Labman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_labman/32/52975_2.png) [@Mike\_Labman](https://discuss.elastic.co/u/Mike_Labman)\
**Post date:** [June 15, 2020, 5:52pm UTC](https://discuss.elastic.co/t/decode-and-add-derived-custom-fields/237175/1 "2020-06-15T17:52:23Z")

</div>

I am brand new to elastic. I have regularly incoming data that has an encoded field, i.e.

```auto
{
id: 1,
time: "2020-06-15 13:45:00",
encoded: "AAIBdQYmaSUAoPy2Bbx7bP9QX4V3UKCHbYGfxjz"
}

```

I have external javascript that I use to decode that into something like this:

```auto
Field1: "Hello"
Field2: 10.5
Field3: 75
Field4: ...
etc.

```

I'm open to re-writing it in any language, but have no idea what the easiest tool to use or where to put the code. Not sure if this can be done with logstash or I need to bring in beats, or what?

---

<div class="post-metadata">

**Author:** ![Ranjith\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ranjith_m/32/19272_2.png) [@Ranjith\_M](https://discuss.elastic.co/u/Ranjith_M)\
**Post date:** [June 15, 2020, 8:57pm UTC](https://discuss.elastic.co/t/decode-and-add-derived-custom-fields/237175/2 "2020-06-15T20:57:54Z")

</div>

@Mike_Labman You can try decoding using logstash ruby filter. You can write custom logic in ruby filter.

Please refer to logstash ruby docs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2020, 8:57pm UTC](https://discuss.elastic.co/t/decode-and-add-derived-custom-fields/237175/3 "2020-07-13T20:57:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.