# Filebeat Azure Module Base64 Issue

**URL:** <https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [March 31, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198 "2022-03-31T13:16:33Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gosborne](https://avatars.discourse-cdn.com/v4/letter/g/8c91f0/32.png) [@Gosborne](https://discuss.elastic.co/u/Gosborne)\
**Post date:** [March 31, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/1 "2022-03-31T13:16:33Z")

</div>

Good Afternoon,

We currently get the error below when running the azure module on Filebeat 8.0.1

```auto
@timestamp":"2022-03-31T12:45:12.573Z","log.logger":"azure-eventhub input","log.origin":{"file.name":"azureeventhub/input.go","file.line":113},"message":"illegal base64 data at input byte 84","service.name":"filebeat","connection string":"Endpoint=sb://signin-eventhub.servicebus.windows.net/","ecs.version":"1.6.0"}

```

Am I right in saying that Filebeat only supports standard Base64 and not URL Safe Base64, thus causing an issue with the - in the endpoint URL?

If this is the case then is it just a case of redoing the Eventhub namespace without the - in the name or is there another solution to this?

---

<div class="post-metadata">

**Author:** ![Ali\_Sanhaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_sanhaji/32/103985_2.png) [@Ali\_Sanhaji](https://discuss.elastic.co/u/Ali_Sanhaji)\
**Post date:** [April 5, 2022, 1:33pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/2 "2022-04-05T13:33:13Z")

</div>

I have the same issue. So removing the '-' from the event hub name can solve the issue ?

---

<div class="post-metadata">

**Author:** ![Gosborne](https://avatars.discourse-cdn.com/v4/letter/g/8c91f0/32.png) [@Gosborne](https://discuss.elastic.co/u/Gosborne)\
**Post date:** [April 5, 2022, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/3 "2022-04-05T13:54:30Z")

</div>

Afternoon,

Yes found that this resolved the issue.

Filebeat uses standard Base64 in which the '-' is not a valid character.  
Change the Namespace to without the - and it all works.

---

<div class="post-metadata">

**Author:** ![Ali\_Sanhaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_sanhaji/32/103985_2.png) [@Ali\_Sanhaji](https://discuss.elastic.co/u/Ali_Sanhaji)\
**Post date:** [April 5, 2022, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/4 "2022-04-05T13:55:55Z")

</div>

Thanks a lot !

---

<div class="post-metadata">

**Author:** ![Ali\_Sanhaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_sanhaji/32/103985_2.png) [@Ali\_Sanhaji](https://discuss.elastic.co/u/Ali_Sanhaji)\
**Post date:** [April 5, 2022, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/5 "2022-04-05T15:12:59Z")

</div>

I removed the '-' but il still doesn't work. My error is "illegal base64 data at input byte 24"

Any suggestions please ? Thanks

---

<div class="post-metadata">

**Author:** ![Gosborne](https://avatars.discourse-cdn.com/v4/letter/g/8c91f0/32.png) [@Gosborne](https://discuss.elastic.co/u/Gosborne)\
**Post date:** [April 5, 2022, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/6 "2022-04-05T15:31:26Z")

</div>

Can you supply the Error message you're seeing, should hopefully provide some better insight into the differences between our setups.

---

<div class="post-metadata">

**Author:** ![Ali\_Sanhaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_sanhaji/32/103985_2.png) [@Ali\_Sanhaji](https://discuss.elastic.co/u/Ali_Sanhaji)\
**Post date:** [April 5, 2022, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/7 "2022-04-05T15:36:35Z")

</div>

Yes of course:

{"log.level":"error","@timestamp":"2022-04-05T15:29:13.352Z","log.logger":"azure-eventhub input","log.origin":{"file.name":"azureeventhub/input.go","file.line":113},"message":"illegal base64 data at input byte 24","service.name":"filebeat","connection string":"Endpoint=sb://eventhubdmznonprd.servicebus.windows.net/","ecs.version":"1.6.0"}

---

<div class="post-metadata">

**Author:** ![Ali\_Sanhaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_sanhaji/32/103985_2.png) [@Ali\_Sanhaji](https://discuss.elastic.co/u/Ali_Sanhaji)\
**Post date:** [April 6, 2022, 8:16am UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/8 "2022-04-06T08:16:06Z")

</div>

Any clues ? I don't understand the illegal base64 data at input byte 24. How do I know where the byte 24 is ?

Thanks

---

<div class="post-metadata">

**Author:** ![Ali\_Sanhaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_sanhaji/32/103985_2.png) [@Ali\_Sanhaji](https://discuss.elastic.co/u/Ali_Sanhaji)\
**Post date:** [April 7, 2022, 10:06am UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/9 "2022-04-07T10:06:14Z")

</div>

My issue was due to the storage account key which doesn't accept a SAS string.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2022, 12:07pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-base64-issue/301198/10 "2022-05-05T12:07:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
