URL decode processor

The urldecode processor is useful for decoding URL-encoded strings in log data or other text fields. This can make the data more readable and easier to analyze, especially when working with URLs or query parameters that contain special characters or spaces.

The following is the syntax for the urldecode processor:

  1. {
  2.   "urldecode": {
  3.     "field": "field_to_decode",
  4.     "target_field": "decoded_field"
  5.   }
  6. }

copy

Configuration parameters

The following table lists the required and optional parameters for the urldecode processor.

ParameterRequired/OptionalDescription
fieldRequiredThe field containing the URL-encoded string to be decoded.
target_fieldOptionalThe field in which the decoded string is stored. If not specified, then the decoded string is stored in the same field as the original encoded string.
ignore_missingOptionalSpecifies whether the processor should ignore documents that do not contain the specified field. If set to true, then the processor ignores missing values in the field and leaves the target_field unchanged. Default is false.
descriptionOptionalA brief description of the processor.
ifOptionalA condition for running the processor.
ignore_failureOptionalSpecifies whether the processor continues to run even if it encounters an error. If set to true, then failures are ignored. Default is false.
on_failureOptionalA list of processors to run if the processor fails.
tagOptionalAn identifier tag for the processor. Useful for debugging in order to distinguish between processors of the same type.

Using the processor

Follow these steps to use the processor in a pipeline.

Step 1: Create a pipeline

The following query creates a pipeline named urldecode_pipeline that uses the urldecode processor to decode the URL-encoded string in the encoded_url field and store the decoded string in the decoded_url field:

  1. PUT _ingest/pipeline/urldecode_pipeline
  2. {
  3.   "description": "Decode URL-encoded strings",
  4.   "processors": [
  5.     {
  6.       "urldecode": {
  7.         "field": "encoded_url",
  8.         "target_field": "decoded_url"
  9.       }
  10.     }
  11.   ]
  12. }

copy

Step 2 (Optional): Test the pipeline

It is recommended that you test your pipeline before you ingest documents.

To test the pipeline, run the following query:

  1. POST _ingest/pipeline/urldecode_pipeline/_simulate
  2. {
  3.   "docs": [
  4.     {
  5.       "_source": {
  6.         "encoded_url": "https://example.com/search?q=hello%20world"
  7.       }
  8.     }
  9.   ]
  10. }

copy

Response

The following example response confirms that the pipeline is working as expected:

  1. {
  2.   "docs": [
  3.     {
  4.       "doc": {
  5.         "_index": "_index",
  6.         "_id": "_id",
  7.         "_source": {
  8.           "decoded_url": "https://example.com/search?q=hello world",
  9.           "encoded_url": "https://example.com/search?q=hello%20world"
  10.         },
  11.         "_ingest": {
  12.           "timestamp": "2024-04-25T23:16:44.886165001Z"
  13.         }
  14.       }
  15.     }
  16.   ]
  17. }

copy

Step 3: Ingest a document

The following query ingests a document into an index named testindex1:

  1. PUT testindex1/_doc/1?pipeline=url_decode_pipeline
  2. {
  3.   "encoded_url": "https://example.com/search?q=url%20decode%20test"
  4. }

copy

Response

The preceding request indexes the document into the index testindex1 and indexes all documents containing the encoded_url field, which is processed by the urldecode_pipeline to populate the decoded_url field, as shown in the following response:

  1. {
  2.   "_index": "testindex1",
  3.   "_id": "1",
  4.   "_version": 67,
  5.   "result": "updated",
  6.   "_shards": {
  7.     "total": 2,
  8.     "successful": 1,
  9.     "failed": 0
  10.   },
  11.   "_seq_no": 68,
  12.   "_primary_term": 47
  13. }

copy

Step 4 (Optional): Retrieve the document

To retrieve the document, run the following query:

  1. GET testindex1/_doc/1

copy

Response

The response includes the original encoded_url field and the decoded_url field:

  1. {
  2.   "_index": "testindex1",
  3.   "_id": "1",
  4.   "_version": 67,
  5.   "_seq_no": 68,
  6.   "_primary_term": 47,
  7.   "found": true,
  8.   "_source": {
  9.     "decoded_url": "https://example.com/search?q=url decode test",
  10.     "encoded_url": "https://example.com/search?q=url%20decode%20test"
  11.   }
  12. }

copy