Decode Base64

[Khaled_Aldughili]

hello ,

I am a bit new to ELK, I am trying to decode a base64 field to show as a string.

I read through some articles that suggest using ingest pipeline,

how would i do that exactly?

PS: I tried runtime fields, but it's not what the team wants.

[chouben (Christof H)]

Hi

Based on your statement, I assume you have 3 components running: elasticsearch, logstash & kibana. Currently the naming is Elastic Stack (since the introduction of Beats).

Question has been asked multiple times, so Google to the rescue::

Base64 decode

Hello all, I am working on something I have never worked on before and I really do not know where to go from here and I am hoping someone might have some direction for me to attempt trying to get this parsed to Elasticsearch properly. I have been given a sample JSON file to parse to ES using logstash however they are requesting that we if we want to review the relevant information, we would have to decode via base64. Given that I have never worked on something like this before, I did a bit of …

Can Logstash Base64 decode then parse json from a cloudfront log?

Hello, we are using AWS's image resizer Serverless Image Handler | Implementations | AWS Solutions To get an image, you need to base64 encode a json object such as {"bucket":"my-s3-bucket","key":"path/to/your/image.jpg","edits":{"resize":{"width":200,"fit":"cover"}}} which becomes eyJidWNrZXQiOiJteS1zMy1idWNrZXQiLCJrZXkiOiJwYXRoL3RvL3lvdXIvaW1hZ2UuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyMDAsImZpdCI6ImNvdmVyIn19fQ== So you would end up with a url of https://random-letters.cloudfront.net/e…

Base64 decode issue

Hi Team, Does Anyone know how to decode base64 in logstash? Logfile : {"ID":"11166946081959","Type":"LOG","pID":"rajesh.r@gmail.com","Interface":"Offboarding","payload": "PD94bWzCoHZlcnNpb249IjEuMCLCoGVuY29kaW5nPSJJU08tODg1OS0xIj8+wqDCoDxub3RlPsKgwqDCoDx0bz5Ub3ZlPC90bz7CoMKgwqDCoDxmcm9tPkphbmk8L2Zyb20+wqDCoMKgwqA8aGVhZGluZz5SZW1pbmRlcjwvaGVhZGluZz7CoMKgwqDCoDxib2R5PkRvbid0wqBmb3JnZXTCoG1lwqB0aGlzwqB3ZWVrZW5kITwvYm9keT7CoMKgPC9ub3RlPsKg"} Config file: input { file{ path => "/home/rajesh/ELK…

PS: elasticsearch has also ingestion pipelines, but logstash is build for parsing..

Best regards
Christof

[Khaled_Aldughili]

thank you I remember trying one of these solutions and didn't work for me.

I tried the other solution and with little tweaks it worked.

thank you so much.

[chouben (Christof H)]

They all suggest the same decoding method

Good you were able to resolve it!