Mutate>Convert and URL Decode

Elastic Stack Logstash
1

I am ingesting a document that is encoded as UTF-8BOM. This is causing an issue with the urldecode filter, though every other filter (json, mutate, translate, etc...) seems to process it just fine without changing the default selected charset.

I was wondering, could I resolve the issue by passing the field I want urldecode to look at to mutate's convert string function?

field to decode: url_lookup

...
mutate {
  convert => {
    "url_lookup" => "string"
  }
}
urldecode {
  field => "url_lookup"
}
...
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.