Performs Base64 decoding of a field. The decoded value is subsequently decoded as binary representation of a string according to the charset parameter. To work with actual binary data, use ISO-8859-1 character set.

To reverse the decoding, use the base64Encode() function: 

base64Encode(a, as=a) | base64Decode(field=a, as=a)
ParameterTypeRequiredDefault ValueDescription
asstringoptional[a] _base64Decode Name of the field in which to store the decoded value.
charsetstringoptional[a] UTF-8 The character set to use when transforming bytes to string.
   Values
   ISO-8859-1
   UTF-16BE
   UTF-16LE
   UTF-8
field[b]stringrequired   The field on which to decode Base64 values.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Behavior on Invalid Encoding

An input field that does not contain a valid Base64 encoding may result in the following behavior:

  • Characters outside the base encoding alphabet are ignored.

  • If the base encoding is invalid, the output field is not created.

  • When decoding to a code point that is invalid with respect to the selected charset, the invalid code point is replaced with a placeholder character.

Click + next to an example below to get the full details.

Perform Base64 Decoding of a Field

Perform Base64 decoding of a field using base64Decode() function

Query
logscale
decoded := base64Decode(encoded)
Introduction

In this example, the base64Decode() function is used to manipulate character strings that are base64 encoded and return a base64-decoded version of the input string.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    decoded := base64Decode(encoded)

    Decodes the Base64 value in encoded and stores it in the field decoded (the field on which to decode Base64 values). The decoded value is subsequently decoded as binary representation of a string according to the charset parameter. The charset parameter is the character set to use when transforming bytes to string. To work with binary data, use ISO-8859-1 character set.

  3. Event Result set.

Summary and Results

The query is used to filter on input fields that do not contain a valid Base64 encoding. When decoding to a code point that is invalid with respect to the selected charset, the invalid code point is replaced with a placeholder character. This process ensures that data can be easily processed by computers.