Filebeat - Base64 Decode - "key not found" - 7.6.1

Elastic Stack Beats
1

I'm trying to use the "decode_base64_field" processor, and have created an extremely simple use case, but it's failing with the following error:

failed to decode base64 fields in processor: could not fetch base64 value for key: cookie, Error: key not found

My processor syntax is the following:

- decode_base64_field:
    field:
      from: "cookie"
      to: "cookie.decoded"
    ignore_missing: false
    fail_on_error: true

My file is extremely simple, just one key-value pair:

{"cookie":"IlNFU1NJT049TEtBSkRGSUVMQUpLTERGSnsidG9rZW4iOiI5OExLSk9GSUo5MzM4SEpBT05VSUhFRkFERk5MS0NKTktBSkRGIn0i"}

Any ideas where I'm going wrong?

2

Please post your log file, processors configuration and target document. Please remember to redact confidential data.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.