# Logstash Converting Base64 IP to Decimal IP

**URL:** <https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153>\
**Category:** Logstash\
**Created:** [October 7, 2021, 5:21pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153 "2021-10-07T17:21:06Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 7, 2021, 5:21pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/1 "2021-10-07T17:21:06Z")

</div>

Hello,

I'm trying to convert a base64 IP into a decimal IP. I saw that Logstash Ruby filter plugin can assist with this by parsing the message field, but is there a way to do this for just an IP field?

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 7, 2021, 6:25pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/2 "2021-10-07T18:25:37Z")

</div>

**Test Conf**

```auto
input { generator { lines => ['{ "base64_ip": "OC44LjguOA==" }'] count => 1 codec => "json" } }
filter {
 ruby { 
  code => 'event.set("decoded_ip", Base64.decode64(event.get("base64_ip")))' 
 }
}    
output { stdout { codec => json_lines } }

```

**Output**

```auto
{
    "base64_ip": "OC44LjguOA==",
    "decoded_ip": "8.8.8.8"
}

```

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 8, 2021, 12:05pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/3 "2021-10-08T12:05:37Z")

</div>

Thank you @aaron-nimocks!

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 11:22am UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/4 "2021-10-12T11:22:07Z")

</div>

Hi @aaron-nimocks,

I tried using the ruby script, but now I have a problem and two questions.

The problem is whenever I decode the IP address it shows as "45\xE1\xBC".

First question is can you run the ruby filter on an array of base64 encoded IPs. Secondly, can I use nested notation in the ruby filter (e.g., "[ip][ip][$binary]")? The raw nested fields looks identical to the one I provided.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 12, 2021, 11:27am UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/5 "2021-10-12T11:27:16Z")

</div>

Can you provide a sample of the data so I can see what it looks like?

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 11:34am UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/6 "2021-10-12T11:34:47Z")

</div>

@aaron-nimocks

```auto
"ip": { "ip": [{"$binary": "dnv5cg==", "$type": "00" }, {"$binary": "t4Ob4A==", "$type": "00" }, {"$binary": "24pmWw==", "$type": "00" }]}

```

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 11:39am UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/7 "2021-10-12T11:39:36Z")

</div>

@aaron-nimocks I forgot the nested ip object.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 12, 2021, 11:39am UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/8 "2021-10-12T11:39:49Z")

</div>

I am not sure what those values are but when I put them into a [base64 decode tool](https://codebeautify.org/base64-decode) they don't represent an IP and that is what I was basing my solution off of.

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 11:44am UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/9 "2021-10-12T11:44:22Z")

</div>

@aaron-nimocks when I use [CyberChef](https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)To_Decimal('Space',false)&input=ZG52NWNnPT0)

```auto
dnv5cg== converts to 118 123 249 114 without a delimiter. Unfortunately Cyber Chef doesn't have the dot delimiter which I know I could probably add that using a gsub filter.

```

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 12, 2021, 12:02pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/10 "2021-10-12T12:02:51Z")

</div>

Interesting. When I just do a [normal base64 decode](https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)&input=ZG52NWNnPT0) on there it looks to give the same results as I did. You are adding a To Decimal function which does `Converts the input data to an ordinal integer array. `

I am not familiar with this enough to speak on it but I think the first step would be to figure out if Ruby can do that function.

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 12:08pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/11 "2021-10-12T12:08:37Z")

</div>

@aaron-nimocks you're right. CyberChef allows you to force the input to decimal whereas, the ruby filter may not recognize it and converts the value to Hex instead. Is there a cheatsheet of some kind to see Ruby filter functions?

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 12:27pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/12 "2021-10-12T12:27:03Z")

</div>

I also noticed that I was getting unpacking errors.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 12, 2021, 12:49pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/13 "2021-10-12T12:49:47Z")

</div>

The answer is yes it can be done but it would take me awhile to figure out. I may have time later or another day. Throw this in a [Ruby playgound](https://try.ruby-lang.org/playground/) and you can see the results.

```auto
base64_ip = "dnv5cg=="
decoded_ip = Base64.decode64(base64_ip)

decoded_ip.each_char { |c| 
  puts c.ord
}

```

First you do a base64 decode.  
Then you loop through that result 1 character at a time.  
Then you apply `.ord` which gets the value of the character.

Now you would just need to tie that all back into a single string with decimals in between.

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 1:05pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/14 "2021-10-12T13:05:01Z")

</div>

@aaron-nimocks ok thanks for your help so far. I will try to build off of what you've given me, but if I can't figure it out I will wait on your solution.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 12, 2021, 1:31pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/15 "2021-10-12T13:31:27Z")

</div>

Try this. It will only work with IPV4 and there could be a better programic solution to this.

**Test Conf**

```auto
input { generator { codec => json count => 1 lines => ['{ "ip": "dnv5cg==" }'] } }
filter {
  ruby {
      code => '
        decoded_ip = Base64.decode64(event.get("ip")).chars
        event.set("parsed_ip", decoded_ip[0].ord.to_s + "." + decoded_ip[1].ord.to_s + "." + decoded_ip[2].ord.to_s + "." + decoded_ip[3].ord.to_s)
      '
  }
}
output {
  stdout { codec => json }
}

```

Output

```auto
{
    "parsed_ip": "118.123.249.114",
    "ip": "dnv5cg=="
}

```

Also I know it doesn't solve your entire problem because your input data is in an array. This was just to show it can be solved in Ruby when it comes to the conversion.

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 1:58pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/16 "2021-10-12T13:58:58Z")

</div>

@aaron-nimocks thanks! Does this work with nested field notation? Ex. [ip][ip][$binary]

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 12, 2021, 2:10pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/17 "2021-10-12T14:10:53Z")

</div>

> [@aaron-nimocks](#):
>
> `(event.get("ip")`

You select the field here. So it will. Never tested a `$` in a fieldname in Ruby though so that could be an issue.

```auto
(event.get("[ip][ip][$binary]")

```

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 2:11pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/18 "2021-10-12T14:11:37Z")

</div>

@aaron-nimocks no worries. I will just rename the field before the ruby filter.

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 12, 2021, 2:36pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/19 "2021-10-12T14:36:20Z")

</div>

This worked for me! Now if I can loop through the array that would be Gold!

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 12, 2021, 3:07pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153/20 "2021-10-12T15:07:49Z")

</div>

Here's how to loop through the array.

**Test Conf**

```auto
input { generator { codec => json count => 1 lines => ['{ "ip": { "ip": [ {"$binary": "dnv5cg==", "$type": "00" }, {"$binary": "t4Ob4A==", "$type": "00" }, {"$binary": "24pmWw==", "$type": "00" }]}}' ] } }
filter {
  ruby {
      code => '
        event.get("[ip][ip]").each_with_index do |value, index|
          decoded_ip = Base64.decode64(value["$binary"]).chars
          event.set("[ip][ip][#{index}][parsed_ip]", decoded_ip[0].ord.to_s + "." + decoded_ip[1].ord.to_s + "." + decoded_ip[2].ord.to_s + "." + decoded_ip[3].ord.to_s)    
        end
      '
  }
}
output {
  stdout { codec => json }
}

```

**Output**

```auto
{
    "ip": {
        "ip": [
            {
                "$type": "00",
                "parsed_ip": "118.123.249.114",
                "$binary": "dnv5cg=="
            },
            {
                "$type": "00",
                "parsed_ip": "183.131.155.224",
                "$binary": "t4Ob4A=="
            },
            {
                "$type": "00",
                "parsed_ip": "219.138.102.91",
                "$binary": "24pmWw=="
            }
        ]
    }
}

```

[Next page](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153.md?page=2)