# How can we decrypt JWT based cookies in logstash and
**URL:** https://discuss.elastic.co/t/how-can-we-decrypt-jwt-based-cookies-in-logstash-and/135139
**Category:** Elasticsearch
**Created:** [June 8, 2018, 11:25am UTC](https://discuss.elastic.co/t/how-can-we-decrypt-jwt-based-cookies-in-logstash-and/135139 "2018-06-08T11:25:11Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@salil](https://discuss.elastic.co/u/salil)
#### Post date: [June 8, 2018, 11:25am UTC](https://discuss.elastic.co/t/how-can-we-decrypt-jwt-based-cookies-in-logstash-and/135139/1 "2018-06-08T11:25:12Z")
I have nginx logs in json format which has incoded JWT auth\_cookie field. How can i parse auth\_cookie field in logstash so i can parse the auth\_email value from auth\_cookie field to send it elastic search. i check [https://www.elastic.co/guide/en/logstash/current/plugins-filters-cipher.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-cipher.html). I am not sure how we can use this.
my log format is
{ "@version": "1", "@timestamp": "2018-06-06T20:27:29+00:00", "auth\_cookie": "JWT\_COOKIE=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImRldiJ9.eyJleHAiOjE1MjgzMjgzNDQsInN1YiI6ImFsZXgucG9tYXRhQGhwZS5jb20iLCJyb2xlcyI6WyJhZG1pbiJdLCJ0ZW5hbnRzIjpbImhwIl0sImF1dGhlbnRpY2F0b3IiOiJsZGFwIiwicHJvZmlsZUlkIjoiIiwibmFtZSI6IkFsZXggUG9tYXRhIiwiZW1haWwiOiJhbGV4LnBvbWF0YUBocGUuY29tIiwidmVyaWZpZWRFbWFpbCI6ImFsZXgucG9tYXRhQGhwZS5jb20iLCJ1c2VySWQiOiJhbGV4LnBvbWF0YUBocGUuY29tIiwiYXV0aFR5cGUiOiJ1c2VyIiwiYWNjZXNzS2V5IjoiIiwiaXNzIjoiaW5mb3NpZ2h0LmF1dGgiLCJpYXQiOjE1MjgyODUxNDQsIm5iZiI6MTUyODI0MTk0NH0.tpkOwJhm\_I328k8gLuSHN8wH-3qTjjkZ5E4hlRIpQ-2kYHOyf-QOOscYAjECFpZbV8Y9NXnih6XejLyJBfkdSKl\_HH4n4nFblE-vAYmbhm-BU\_dRNCaRGExk6Sbe5IC9DZ5D-xtwT40j8-EQkQ8c0SVnkbZUP0BvXkn0LwruLKSKsZ3-UYwMR30Gc822lcK8tm3oV3ZjLVIrB-IyZcvJ8iLx9cQ14tdKtFEJE79JdB5dcOHfpRDQktSLoKyIGPBuK-0RF50REdaeC3d919Kv6vcJBr21iS-TET6dhSP3u3jlmN68I-LqGBhVsxpk6LVFw6fHJmWnX8nENHelvntfiw; SESSION=8bf2b132-8350-4d1e-a2db-0dfcb1b93418", "auth\_set\_cookie": "", "http\_accept\_language": "en-US,en;q=0.9", "http\_client\_ip": "16.200.16.61", "http\_client\_user": "-", "http\_host": "[dev.infosight.abc.com](http://dev.infosight.abc.com)", "http\_method": "GET", "http\_request\_bytes": "1813", "http\_request\_secs": "0.016", "http\_request\_uri": "/auth/user/profile", "http\_request\_path": "/auth/user/profile", "http\_request\_query": "-", "http\_response\_bytes": "715", "http\_response\_content\_type": "application/json", "http\_referrer": "[https://localhost:9090/infrastructure/storage/storeserv/systems/1203859/1203859/overview?f\_sort=status.score%3Adesc&f\_q=capacity.total.freeTiB%3A\>%3D97%20system.location.region%3AAPJ%20system.osVersion%3A"2.3.1.298%20(MU3)"%20system.osVersion%3A"3.1.1.448%20(MU3)"](https://localhost:9090/infrastructure/storage/storeserv/systems/1203859/1203859/overview?f_sort=status.score%3Adesc&f_q=capacity.total.freeTiB%3A%3E%3D97%20system.location.region%3AAPJ%20system.osVersion%3A%222.3.1.298%20(MU3)%22%20system.osVersion%3A%223.1.1.448%20(MU3)%22)", "http\_scheme": "https", "http\_status": "200", "http\_user\_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_13\_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36", "http\_version": "HTTP/1.1" }
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2018, 11:25am UTC](https://discuss.elastic.co/t/how-can-we-decrypt-jwt-based-cookies-in-logstash-and/135139/2 "2018-07-06T11:25:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.