# Filebeat - Base64 Decode - "key not found" - 7.6.1

**URL:** <https://discuss.elastic.co/t/filebeat-base64-decode-key-not-found-7-6-1/223229>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 11, 2020, 11:22pm UTC](https://discuss.elastic.co/t/filebeat-base64-decode-key-not-found-7-6-1/223229 "2020-03-11T23:22:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bgeveritt](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@bgeveritt](https://discuss.elastic.co/u/bgeveritt)\
**Post date:** [March 11, 2020, 11:22pm UTC](https://discuss.elastic.co/t/filebeat-base64-decode-key-not-found-7-6-1/223229/1 "2020-03-11T23:22:14Z")

</div>

I'm trying to use the "decode\_base64\_field" processor, and have created an extremely simple use case, but it's failing with the following error:

`failed to decode base64 fields in processor: could not fetch base64 value for key: cookie, Error: key not found`

My processor syntax is the following:

```
- decode_base64_field:
    field:
      from: "cookie"
      to: "cookie.decoded"
    ignore_missing: false
    fail_on_error: true

```

My file is extremely simple, just one key-value pair:

`{"cookie":"IlNFU1NJT049TEtBSkRGSUVMQUpLTERGSnsidG9rZW4iOiI5OExLSk9GSUo5MzM4SEpBT05VSUhFRkFERk5MS0NKTktBSkRGIn0i"}`

Any ideas where I'm going wrong?

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 12, 2020, 7:52am UTC](https://discuss.elastic.co/t/filebeat-base64-decode-key-not-found-7-6-1/223229/2 "2020-03-12T07:52:27Z")

</div>

Please post your log file, processors configuration and target document. Please remember to redact confidential data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2020, 7:52am UTC](https://discuss.elastic.co/t/filebeat-base64-decode-key-not-found-7-6-1/223229/3 "2020-04-09T07:52:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.