The urldecode ingest processor will convert decode+me => decode me, but the logstash filter plugin only handles %-encoded values, so + are not replaced with spaces.
The workaround is to add a gsub filter above the urldecode filter, but is there any reason to not add this to the one plugin?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.