logstash base64解码字段

来源：互联网发布：未播先火的网络剧编辑：程序博客网时间：2024/06/03 16:35

需求场景：需要base64解码filebeat上传的某个字段，然后es方便做聚合

filter {     grok {        match => {            "message" => "%{DATA:mark}&%{DATA:time}&%{WORD:app}&%{DATA:version}&%{DATA:deviceid}&%{DATA:channel}&%{DATA:uid}&%{INT:types}&%{DATA:position}&%{DATA:environment}&%{DATA:operator}&%{DATA:sysinfo}&%{GREEDYDATA:msg}"        }         remove_field => ['type','_id','input_type','tags','message','beat','source','offset']    }    if [types] in ['1','2','3','4','5'] {        ruby {            init => "require 'base64'"            code => "event['b64_decoded'] = Base64.decode64(event['msg']) if event.include?('msg')"     #这里解码出刚刚截取出来的msg字段        }        json {            source => "b64_decoded"                            #因为b64_decoded解码出来json，需要继续进行解析            remove_field => ['b64_decoded']        }    }}

参考文档：https://gist.github.com/bfritz/7831984#file-ruby_filter_base64_decode_example-sh-L15

1 0